.. / Dllhost.exe

Star

• Execute

Used by Windows to DLL Surrogate COM Objects

Paths:

• C:\Windows\System32\dllhost.exe
• C:\Windows\SysWOW64\dllhost.exe

Acknowledgement:
Jai Minton - @CyberRaiju
Nasreddine Bencherchali - @nas_bench

Detection:

Execute

dllhost.exe /Processid:{CLSID}