dllhost.exe
Summary
COM Surrogate (dllhost.exe) hosts COM objects that run outside of the process that requested them. It provides a separate process space for COM DLLs, isolating the calling process from crashes in the COM object. It is commonly seen hosting thumbnail generators, shell extensions, and other COM-based functionality.
dllhost.exe is the 31st most commonly executed Windows program in EchoTrail's dataset, observed 1,633,433 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System3293.78%
- C:\Windows\SysWOW646.22%
Top Hashes (SHA256)
- 3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d330.66%
- e7fc40b41aa8b83841a0b96d169eaf0800aa784733e636935374d56536253f1014.05%
- 6a8f00c4bf7ce696edeba9e6c401ff9dd7eb59f34af25d7eee591b4837d67c7c12.45%
- 79756ab8344c31a55223a51625f2379525428cebd53531f11c26544a34621d819.96%
- c4e078607db2784be7761c86048dffa6f3ef04b551354a32fcdec3b6a34509056.61%
- 204fd3da29e9197a7e82ab628e017a74082934e87092afe18d253446608e09716.58%
- 61b8955ce0a2aa9d0719920b30216717b349b6fbe11c697c31cfa84f859cc1ae4.17%
- 1128499ac255bb11f25cd617f766b15f65f9eab1e0a531200c3878e80c96e41e2.55%
- 3ed69caab035258e008efbcf40db305891b40ba02ca2737e20defa7c2d4afaf72.38%
- da2a486f74498e403b8f28da7b0d1bd76930bfaff840c60ca4591340fbeceaf61.92%
Process Ancestry
Top Grandparents
- services.exe99.71%
- wininit.exe0.12%
- FortniteLauncher.exe<0.01%
- svchost.exe<0.01%
Top Parents
- svchost.exe99.72%
- services.exe0.08%
- Recroom_Oculus.exe0.01%
Top Children
- mighost.exe46.86%
- rundll32.exe31.79%
- SrTasks.exe8.5%
- WerFault.exe7.04%
- unins000.exe0.57%
- Uninstall.exe0.51%
- OfficeClickToRun.exe0.36%
- setup.exe0.29%
- mmc.exe0.16%
- notepad++.exe0.14%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does dllhost.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Launched by svchost.exe (hosting the DcomLaunch service) or occasionally services.exe. Multiple instances are normal. Command-line typically contains /Processid: with a CLSID. Common children include mighost.exe, rundll32.exe, and WerFault.exe (crash handler).
When is dllhost.exe suspicious?
Parent process other than svchost.exe or services.exe. Running from a path outside System32 or SysWOW64. Spawning shells (cmd.exe, powershell.exe) or network tools. Making unusual outbound network connections. Absent or suspicious /Processid: CLSID in the command-line.
How do attackers abuse dllhost.exe?
Process injection: attackers inject code into dllhost.exe because it is a trusted, commonly-running process. DCOM lateral movement: certain DCOM objects hosted by dllhost.exe can be abused for remote code execution (e.g., MMC20.Application, ShellWindows, ShellBrowserWindow). Name masquerading: malware may use the name dllhost.exe to avoid suspicion.
Detection guidance
High-confidence: dllhost.exe spawning cmd.exe, powershell.exe, or other shells. dllhost.exe running from a non-standard path. Medium-confidence: dllhost.exe with unusual /Processid: CLSIDs associated with known DCOM lateral movement techniques. Monitor for Sysmon Event ID 1 with parent-child relationships and Event ID 3 for network connections.
False positive notes
Multiple instances of dllhost.exe are normal. Thumbnail generation, preview handlers, and shell extensions all trigger dllhost.exe. Some applications launch their COM objects in dllhost.exe as part of normal operation. WerFault.exe as a child indicates a crashed COM object, not necessarily malicious activity.
Related Processes
Ask Rocky about dllhost.exe
Rocky answers questions about dllhost.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.