CmdID

CmdID / Files

dllhost.exe

COM Surrogate file version info

Program on Windows 14 known copies with hashes 26 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dllhost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCOM Surrogate

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dllhost.exe · signed by Microsoft Windows

39a4819265d67c89919672d415e22edb5f74a47bcf28ceef49f1ace80a721874

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dllhost.exe · signed by Microsoft Windows

7bc7d4062bb3f8271dbc93b5d55011219ad2d8ed0d67aced925e46e7eda9b438

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dllhost.exe · signed by Microsoft Windows

3ed69caab035258e008efbcf40db305891b40ba02ca2737e20defa7c2d4afaf7

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\dllhost.exe · signed by Microsoft Windows

e7fc40b41aa8b83841a0b96d169eaf0800aa784733e636935374d56536253f10

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dllhost.exe · signed by Microsoft Windows

a422fcb92ab03c9f34fe2296028e68911f87eeac4a79b37d3769730ca52a6bf8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dllhost.exe · signed by Microsoft Windows

ffbfd4ea38939327584779f31f46cc8a8afa0ad03a783a35d1c166c335e7b910

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dllhost.exe · signed by Microsoft Windows

4b878483eb200c8731f95096eef036f285bd36ab916fe550dd484b872e60d037

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dllhost.exe · signed by Microsoft Windows

6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dllhost.exe · signed by Microsoft Windows

c4e078607db2784be7761c86048dffa6f3ef04b551354a32fcdec3b6a3450905

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dllhost.exe · signed by Microsoft Windows

f95b7ba752c6452da9d83f84ca7307ae079d220718bcb2babf145903bac894dd

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dllhost.exe · signed by Microsoft Windows

5137c324038ab2e8eab4f98a20bee9f121346d62e4d907ca1e4a860f4c54eae8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dllhost.exe · signed by Microsoft Windows

ee8364c07b3f4f71fa649e0e6c4c73c15d285130e4b16e79890eebbf89c2164e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\dllhost.exe · signed by Microsoft Windows

1128499ac255bb11f25cd617f766b15f65f9eab1e0a531200c3878e80c96e41e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\dllhost.exe · signed by Microsoft Windows

771151fdeb8e30545f4bbfe1b73eee0e1187db905a535e9cc12d2c57aa0acc8d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dllhost.exe
criticalDarkSide Ransomware PatternFlorian Roth (Nextron Systems)
highDllhost.EXE Execution AnomalyNasreddine Bencherchali (Nextron Systems)
highImagingDevices Unusual Parent/Child ProcessesNasreddine Bencherchali (Nextron Systems)
highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
highPotential CobaltStrike Process PatternsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highScript Event Consumer Spawning ProcessSittikorn S
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highUAC Bypass via ICMLuaUtilFlorian Roth (Nextron Systems), Elastic (idea)
highUNC2452 Process Creation PatternsFlorian Roth (Nextron Systems)
highWab/Wabmig Unusual Parent Or Child ProcessesNasreddine Bencherchali (Nextron Systems)
mediumPotentially Suspicious Execution Of PDQDeployRunnerNasreddine Bencherchali (Nextron Systems)
mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names dllhost.exe in 26 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.