4
I have recently discover a new process in the task manager : taskhost.exe
(maybe it was there before but i did not notice it)
As the name implies, it seems to be used for running dll in background (like rundll32.exe
).
Is there a way to know which dll / services this process is hosting ? i would like to know for which purpose it is used and if there is some malware or not.
I know it is possible to see which services svchost.exe
process is hosting using process explorer
utility.
I have checked taskhost.exe
threads and their stacks using process explorer, here is what i get :
So it seems it is used for sound (winmm + playsndsrv). But there is also other things for which very few information is provided (ex : thread 1456, taskhost.exe as start address and nothing relevant can be found in stack (same for 1464, 2272 and so). So maybe it is not the right way to do.