In logs, I found lsass.exe spawning lsass.exe.


lsass.exe should always be a child process of wininit.exe on Windows Vista and later. So, I'm wondering, what can explain such behaviour? Are there legitimate cases where lsass.exe can spawn lsass.exe? I read about process hollowing, but the only examples I could find were services.exe starting lsass.exe.

  • What program have you used to generate the process tree? Are you sure each entry is a separate process (and not just a thread or something like that).
    – Robert
    Mar 9 at 14:32
  • The process tree is generated by a custom Python script. I couldn't tell you exactly how it works. But I can tell you that the two lsass instances in this process tree had different process IDs, does it exclude the thread theory? Mar 9 at 14:39
  • If you see different PIDs then it should be a correct result.
    – Robert
    Mar 9 at 14:44


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.