Yep, this is definitely your case. In DInvoke you only take the first virtual host but api-ms-win-core-processthreads-l1-1-0 has 2, kernel32.dll and kernelbase.dll. You will need to detect the loop somehow and then take the second one. Maybe keeping the previous host?