CmdID

CmdID / Files

Dism.exe

Dism Image Servicing Utility file version info

Program on Windows 18 known copies with hashes 9 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Dism.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDism Image Servicing Utility

18 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Dism.exe · signed by Microsoft Windows

00b01cbe2ca62f9c74835c01b48fec6dc4adf9049bac531d9c3c0ddd9379902a

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Dism.exe · signed by Microsoft Windows

46d22406df80879695ff8e73423cbc3b1aceacc0bdbe1a13b510e170bf87a798

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

2bde775d1adca83f65373fe274edd41722eff8e3b158782563e9a7d1584f08ca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

5bfcead2283dfa23877a1aa924cbe9de2ec203c02b843ae4d99a78d64e86dc7d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

769fe00942eb716ec99a7947cab6b4c8b0647936c01aa27bc249bbec61de82b5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

a7354b9c6297b6b5537d19a12091e7d89bd52e38bc4d9498fa63aa8c3e700cb6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

ca010c46e1b7b986f282c06df69f222c358724b35724e313e5c4c64f55d9f2ba

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

f19943a94922c21f3a642d7501f6d72ed98964f181fd6de893d9ddc812866bca

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Dism.exe · signed by Microsoft Windows

6e8ebf5ec6999883b82b9b41fcd53a4266b236e86cb41fbc450a3b7c64e708c0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Dism.exe · signed by Microsoft Windows

c32cd1528cd9d3a2d6763357061a85d1e02da2209377a4ead1f4f7d7e3c1367c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

1af747dbb1e03359d64925e7d76f7b63127814eebf48449c605372dba22df811

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

2583198aaabbdd48923a9a5ccc6543475311b9bd10988fb77230ee46f02c0c5c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

86352060d90d48affabded6f50ba676f25c472aabf421b17a2b19c0b8c29a1fb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

c044718bec97d72dd0c39bc86191062ccf170facb33fe666333b00cd32bbd006

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\Dism.exe · signed by Microsoft Windows

9f085677c2e919c712c2bf025e0a7fa3f07ceebe76ec81b72c17ed54dd5f330e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Dism.exe · signed by Microsoft Windows

ffa65d0286ef4016cce89abdfb5b6cb30996bcc00fe7e8f440b9af565179e9da

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\system32\Dism.exe · not signed

2fbff06b431e9b0144bfc689e94257b77f9a8f91f03af4851bd100278415a667

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\SysWOW64\Dism.exe · not signed

4434d1ddb000b8014ee7a84d8df27ffb53dbc2bec2e9d9a06631a1d902f0d929

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Dism.exe
highPowerShell Web Access Feature Enabled Via DISMMichael Haag
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highUAC Bypass Using NTFS Reparse Point - ProcessChristian Burkard (Nextron Systems)
highUAC Bypass Using PkgMgr and DISMChristian Burkard (Nextron Systems)
mediumDism Remove Online Packagefrack113
mediumUse Short Name Path in Command Linefrack113, Nasreddine Bencherchali
mediumUse Short Name Path in Imagefrack113, Nasreddine Bencherchali

Sigma names Dism.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.