volatility3 dlllist

vol.py -f mem.dmp windows.dlllist

Lists the DLLs loaded by each process in the dump, detecting unusual modules, those without a file on disk, or from user paths.

Run it when you want to know what libraries a suspicious process loaded: dlllist enumerates the DLLs of each process with their path — and the findings are the modules that shouldn't be there: DLLs from Temp or Downloads (loaded by the loader), modules without a file on disk (injection), or system DLL versions in user paths (hijacking). In memory IR, dlllist confirms the loading mechanism: the legitimate process that loaded the attacker's DLL. It also detects the absence of system DLLs in processes that should have them (hollowing).

Don't use it as a verdict: system processes load dozens of legitimate DLLs and the list is long — the value is in the filter (user paths, modules without path, system DLLs from wrong directories). In processes with many DLLs (browsers, Office), the noise is high. And beware: dlllist relies on the process PEB — hidden modules or those loaded by advanced techniques (manual mapping) don't appear; for those, use malfind and kernel structures (modules plugin). The path of each DLL is the key field: a user path in a system process is the finding.