A module load occurs when a process brings a library or other component into memory so its code or resources can be used. On Windows, this often includes loading a DLL. The module may be loaded when an application starts or later while it is running.
Monitoring module loads helps defenders spot unexpected or malicious code running inside otherwise legitimate processes. For example, DLL side-loading can cause a trusted application to load an attacker-controlled library. Investigators can review which process loaded a module, its file path and signature, and the process’s surrounding activity. An unusual module load is a useful signal, but should be assessed with other evidence because legitimate software also loads many libraries.