dllhost.exe
Sources: 300M+ executions observed in the wild.
Summary
COM Surrogate (dllhost.exe) hosts COM objects that run outside of the process that requested them. It provides a separate process space for COM DLLs, isolating the calling process from crashes in the COM object. It is commonly seen hosting thumbnail generators, shell extensions, and other COM-based functionality.
dllhost.exe is the 31st most commonly executed Windows program in EchoTrail's dataset, observed 1,633,433 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Get this in your tools
The same record for dllhost.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/dllhost.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3293.78%
- C:\Windows\SysWOW646.22%
Top Hashes (SHA256)
- 3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d330.66%
- e7fc40b41aa8b83841a0b96d169eaf0800aa784733e636935374d56536253f1014.05%
- 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c12.45%
- 79756ab8344c31a55223a51625f2379525428cebd53531f11c26544a34621d819.96%
- c4e078607db2784be7761c86048dffa6f3ef04b551354a32fcdec3b6a34509056.61%
- 204fd3da29e9197a7e82ab628e017a74082934e87092afe18d253446608e09716.58%
- 61b8955ce0a2aa9d0719920b30216717b349b6fbe11c697c31cfa84f859cc1ae4.17%
- 1128499ac255bb11f25cd617f766b15f65f9eab1e0a531200c3878e80c96e41e2.55%
- 3ed69caab035258e008efbcf40db305891b40ba02ca2737e20defa7c2d4afaf72.38%
- da2a486f74498e403b8f28da7b0d1bd76930bfaff840c60ca4591340fbeceaf61.92%
Process Ancestry
Top Grandparents
- services.exe99.71%
- wininit.exe0.12%
- FortniteLauncher.exe<0.01%
- svchost.exe<0.01%
Top Parents
- svchost.exe99.72%
- services.exe0.08%
- Recroom_Oculus.exe0.01%
Top Children
- mighost.exe46.86%
- rundll32.exe31.79%
- SrTasks.exe8.5%
- WerFault.exe7.04%
- unins000.exe0.57%
- Uninstall.exe0.51%
- OfficeClickToRun.exe0.36%
- setup.exe0.29%
- mmc.exe0.16%
- notepad++.exe0.14%
Security Analysis
What does dllhost.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Launched by svchost.exe (hosting the DcomLaunch service) or occasionally services.exe. Multiple instances are normal. Command-line typically contains /Processid: with a CLSID. Common children include mighost.exe, rundll32.exe, and WerFault.exe (crash handler).
When is dllhost.exe suspicious?
Parent process other than svchost.exe or services.exe. Running from a path outside System32 or SysWOW64. Spawning shells (cmd.exe, powershell.exe) or network tools. Making unusual outbound network connections. Absent or suspicious /Processid: CLSID in the command-line.
How do attackers abuse dllhost.exe?
Process injection: attackers inject code into dllhost.exe because it is a trusted, commonly-running process. DCOM lateral movement: certain DCOM objects hosted by dllhost.exe can be abused for remote code execution (e.g., MMC20.Application, ShellWindows, ShellBrowserWindow). Name masquerading: malware may use the name dllhost.exe to avoid suspicion.
Detection guidance
High-confidence: dllhost.exe spawning cmd.exe, powershell.exe, or other shells. dllhost.exe running from a non-standard path. Medium-confidence: dllhost.exe with unusual /Processid: CLSIDs associated with known DCOM lateral movement techniques. Monitor for Sysmon Event ID 1 with parent-child relationships and Event ID 3 for network connections.
False positive notes
Multiple instances of dllhost.exe are normal. Thumbnail generation, preview handlers, and shell extensions all trigger dllhost.exe. Some applications launch their COM objects in dllhost.exe as part of normal operation. WerFault.exe as a child indicates a crashed COM object, not necessarily malicious activity.
Related Processes
Ask Rocky about dllhost.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for dllhost.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.