HeapSpray attempt by kernel32.dll

Hello all,

I am a InfoSec analyst supporting Anti-Virus to a client. Recently, I came across a HeapSpray attempt detection on the Windows 10 host for the process excel.exe. After the thorough investigation, i found the source which caused the detection was kernel32.dll. The sandbox result for the dll file was suspicious in its behavior. (Attached is a snapshot)

I would want to know some information about the kernel32.dll file.

1. How does kernel32.dll works when a process is loaded?

2. Does kernel32.dll have privilege to write to Heap?

3. Are "Writing" and "Spraying" to Heap one and the same?

A quick help would be appreciated.

Regards,

Rakshith