DLL loading is the Windows process of a program opening and using a Dynamic Link Library (DLL), which contains reusable code or functions. This is normal software behavior: applications rely on DLLs for features, updates, and shared system components. Because the loader accepts library paths and names, attackers can abuse DLL loading to make malicious code run inside a trusted process or to replace a legitimate library with a tampered one.
In cyber security, DLL loading matters because it can hide execution, blend malware into normal application activity, and complicate detection. Attackers may place a fake DLL beside a legitimate program, modify a search path, or trigger a scheduled task that launches a binary which then loads the malicious library. Defenders watch for unusual DLL locations, unsigned or unexpected libraries, and processes loading DLLs from writable folders such as ProgramData or user directories.