0

In logs, I found lsass.exe spawning lsass.exe.

C:\Windows\System32\smss.exe
 C:\Windows\System32\smss.exe
  C:\Windows\System32\wininit.exe
   C:\Windows\System32\lsass.exe
    C:\WINDOWS\system32\lsass.exe

lsass.exe should always be a child process of wininit.exe on Windows Vista and later. So, I'm wondering, what can explain such behaviour? Are there legitimate cases where lsass.exe can spawn lsass.exe? I read about process hollowing, but the only examples I could find were services.exe starting lsass.exe.

3
  • What program have you used to generate the process tree? Are you sure each entry is a separate process (and not just a thread or something like that).
    – Robert
    Mar 9 at 14:32
  • The process tree is generated by a custom Python script. I couldn't tell you exactly how it works. But I can tell you that the two lsass instances in this process tree had different process IDs, does it exclude the thread theory? Mar 9 at 14:39
  • If you see different PIDs then it should be a correct result.
    – Robert
    Mar 9 at 14:44

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.