Skip to main content

How to List DLLs Used by a Process in Batch Script

When troubleshooting an application, it's often essential to know which Dynamic Link Libraries (DLLs) it has loaded into memory. This can help diagnose problems like "missing DLL" errors, version conflicts (when an application loads an older DLL from an unexpected location), or even to check for suspicious modules loaded by malware.

This guide will teach you how to use the standard, built-in tasklist.exe command with its module-listing feature to see all the DLLs being used by a specific process. You will learn how to filter the output to target a single process and how to save this information to a file for analysis.

The Core Command: tasklist /m​

The tasklist.exe utility is the primary tool for listing running processes. The /m switch is used to list all the DLL modules associated with each task.

Syntax: tasklist /m [<ModuleName>]

  • /m: This switch is the key. It tells tasklist to list all loaded DLLs for each process.
  • <ModuleName>: An optional parameter to find all processes that have a specific DLL loaded.

Running tasklist /m by itself is not very useful, as it will list every DLL for every process, resulting in a massive, hard-to-read output. The real power comes from combining it with a filter.

Filtering to a Specific Process (/FI)​

To make the output useful, you must use the /FI (Filter) switch to narrow down the list to a single process. You can identify the process by its name or its Process ID (PID).

Syntax to Filter by Process Name: tasklist /m /FI "IMAGENAME eq <ProcessName>"

Syntax to Filter by Process ID: tasklist /m /FI "PID eq <ProcessID>"

Basic Example: Listing DLLs for Notepad​

Let's find all the DLLs loaded by notepad.exe.

@ECHO OFF
ECHO --- Listing all DLLs loaded by notepad.exe ---
ECHO.
tasklist /m /FI "IMAGENAME eq notepad.exe"

The output shows the main process (notepad.exe) and then lists every single DLL it has loaded into its memory space.

Image Name                     PID Modules
========================= ======== ============================================
notepad.exe                   5432 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
                                   USER32.dll, win32u.dll, GDI32.dll,
                                   gdi32full.dll, msvcp_win.dll, ucrtbase.dll,
                                   COMDLG32.dll, msvcrt.dll, combase.dll,
                                   RPCRT4.dll, shcore.dll, shlwapi.dll,
                                   IMM32.DLL, OLEAUT32.dll, ole32.dll,
                                   ... (and many more) ...

How to Capture the DLL List in a Script​

To save this information or process it, you can use a FOR /F loop.

Example, this script captures the list of DLLs for a process and echoes them one by one.

@ECHO OFF
SET "ProcessName=notepad.exe"
ECHO --- Capturing DLLs for %ProcessName% ---
ECHO.

REM 'skip=3' ignores the header lines. 'tokens=2' grabs the second column (the module list).
FOR /F "skip=3 tokens=2" %%L IN (
    'tasklist /m /FI "IMAGENAME eq %ProcessName%"'
) DO (
    ECHO %%L
)
note

The DLLs are often listed on multiple lines, and this simple FOR loop will capture and print each of those lines.

How the Command Works​

The tasklist command interfaces with the Windows kernel and the Process Status API (PSAPI). When you use the /m switch, it queries the operating system for a list of all the executable code modules (both .exe and .dll files) that have been mapped into the virtual memory space of the specified process. This provides a direct and accurate snapshot of the process's dependencies at that moment.

Common Pitfalls and How to Solve Them​

Problem: You Need Administrator Rights for a Full View​

If you run tasklist as a standard user, you may not be able to see the modules for processes that are running as a different user or as the SYSTEM account.

Solution: For any serious diagnostic script, you must run the script as an Administrator. This gives tasklist the necessary privileges to inspect almost any process on the system.

Problem: Understanding 32-bit vs. 64-bit Processes​

On a 64-bit version of Windows, you can run both 64-bit and 32-bit applications. When you run tasklist, 32-bit processes are often marked with a *32 next to their image name.

When you list the DLLs for a 32-bit process, you will see that it has loaded the 32-bit versions of the system DLLs, which are typically located in the C:\Windows\SysWOW64 folder. A 64-bit process will load the 64-bit DLLs from C:\Windows\System32. This is normal and expected behavior.

Practical Example: A "DLL Report" Generator Script​

This script takes a process name as a command-line argument and saves a clean list of its loaded DLLs to a text file on the desktop.

@ECHO OFF
SETLOCAL
SET "ProcessName=%~1"

IF "%ProcessName%"=="" (
    ECHO [ERROR] Please provide a process name (e.g., notepad.exe).
    ECHO Usage: %~n0 <ImageName>
    GOTO :End
)

SET "OutputFile=%USERPROFILE%\Desktop\%ProcessName%_DLL_Report.txt"
ECHO --- DLL Report Generator ---
ECHO Creating report for: %ProcessName%
ECHO Saving to: "%OutputFile%"

REM --- Check if the process is running first ---
tasklist /FI "IMAGENAME eq %ProcessName%" 2>NUL | find /I /N "%ProcessName%" > NUL
IF %ERRORLEVEL% NEQ 0 (
    ECHO [FAILURE] Process "%ProcessName%" is not currently running.
    GOTO :End
)

(
    ECHO DLL Report for process: %ProcessName%
    ECHO Generated on: %DATE% at %TIME%
    ECHO ------------------------------------
    tasklist /m /FI "IMAGENAME eq %ProcessName%"
) > "%OutputFile%"

ECHO.
ECHO [SUCCESS] Report created. Opening now...
START "" "%OutputFile%"

:End
ENDLOCAL

Conclusion​

The tasklist /m command is the standard, built-in tool for discovering which DLLs a process has loaded.

Key takeaways for using it in a script:

  • Always combine /m with the filter switch /FI to target a specific process by its IMAGENAME or PID.
  • Run your script as an Administrator to ensure you can see the modules for system-level processes.
  • Redirect the output with > filename.txt to save the list for documentation or troubleshooting.

By using tasklist /m, you can gain deep insight into the runtime dependencies of any application, making it an invaluable tool for any scripter's diagnostic toolkit.

Table of Contents