CmdID

CmdID / Files

DismHost.exe

Dism Host Servicing Process file version info

Program on Windows 17 known copies with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DismHost.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\Dism\
C:\Windows\system32\Dism\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDism Host Servicing Process

17 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

91a681d017c797cd57ba9245912b71dc84ebd051d6b9645e359a25ae772ff42e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Dism\DismHost.exe · signed by Microsoft Windows

dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

795483c8f2901dd399e545178dab52b98a90a62b0ecd4edffd859e5261122cd9

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\Dism\DismHost.exe · signed by Microsoft Windows

e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

4d3b036a78298e64e8fef0010ce98ce8b41e37621b613b4f35ee64765c724393

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Dism\DismHost.exe · signed by Microsoft Windows

21baef2bb5ab2df3aa4d95c8333aadadda61dee65e61ad2dbe5f3dbaddb163c7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

2db594b74d10f59d347f30a9217efa3fec134d73668433fe562ff94e2c95287c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Dism\DismHost.exe · signed by Microsoft Windows

5108587a0713975bbd79a0e1a56b0dd0d0e63d89d7b681d1e0bf7979e21080b0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

ce16713c1a1b97d1e8ad632391531511d2788950a43443ffc776ae25db6f9aa2

10.0.17763.771 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

077c85278d414473eb9807c0f1093bffa8c9ec8dea4f40bd585e4c4c822262b9

10.0.17763.771 (WinBuild.160101.0800) · C:\Windows\system32\Dism\DismHost.exe · signed by Microsoft Windows

b94317b7c665f1cec965e3322e0aa26c8be29eaf5830fb7fcd7e14ae88a8cf22

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

ea7e7d5045d32c114c030e85fb03925690f2fffe93c5eb56209292c3c1154a8c

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\Dism\DismHost.exe · signed by Microsoft Windows

f81b2f9fbbfa6e16d59d8ab703b3ef5a4a63bf4b23e002bd7b5bfa01ce62b937

10.0.14393.3241 (rs1_release_inmarket.190910-1801) · C:\Windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Windows

28107b86dbb48f331eb8b36607df1373a76717dd6a46f664933fdb0b6c2eee8f

10.0.14393.3241 (rs1_release_inmarket.190910-1801) · C:\Windows\system32\Dism\DismHost.exe · signed by Microsoft Windows

33069f383011494299ad95c20d45929d5fc64c0e4e8441c6425f324b02744a20

6.3.9600.19397 (winblue_ltsb.190608-0600) · C:\windows\SysWOW64\Dism\DismHost.exe · signed by Microsoft Corporation

0695d0a7e20bd23dd3761710a223353a33df9ef96f8ad79e76174c9035a1f518

6.3.9600.19397 (winblue_ltsb.190608-0600) · C:\windows\system32\Dism\DismHost.exe · signed by Microsoft Corporation

95aec6d12e6f9e6e1e3045259cf024d30625bf4e520d94f333387359221735e4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name DismHost.exe
highUAC Bypass Using NTFS Reparse Point - ProcessChristian Burkard (Nextron Systems)
mediumDism Remove Online Packagefrack113

Sigma names DismHost.exe in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.