ERAAgent.exe resolver attempts LoadLibrary of dpapisvc.dll

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.