Open Task Manager (Ctrl+Shift+Esc). Look for suspicious processes using high CPU or with random names. Right-click → End task.
The most common issue users face with medal-hook64.dll is antivirus software flagging it as malicious (often as "Trojan.Generic" or "PUP").
This is a classic case of heuristic false positives. medal-hook64.dll
If your antivirus flags this file, it is because the antivirus is doing its job by being suspicious of injection techniques—not because the file is actually harmful. You generally need to add an exclusion for Medal in your antivirus settings to restore functionality.
In software terms, "hooking" allows one program to intercept events or function calls from another program. medal-hook64.dll is responsible for: Open Task Manager (Ctrl+Shift+Esc)
Without this DLL, Medal cannot record inside most modern 3D games.
The core functionality of medal-hook64.dll relies on API Hooking. Specifically, it targets the DirectX API (Direct3D 11, D3D9, or DirectX 12). If your antivirus flags this file, it is
Here is the simplified workflow of what happens once the DLL is loaded:
When the game says, "Hey DirectX, present this frame," the hook intercepts it. The DLL says, "Wait, let me copy this frame to a buffer for encoding." It saves the frame data, then passes control back to the original DirectX function so the game continues running normally.
Temporarily disable other overlay tools (Discord Overlay, NVIDIA ShadowPlay, Steam Overlay) to isolate the issue.