How to Use Process Monitor to Find Malware That Spawns Child Processes

Process Monitor from Sysinternals is one of the sharpest instruments for hunting stealthy infections on Windows. Unlike Task Manager, it captures every file, registry, and process creation event in real time and lets you slice the flood with precise filters. For residents of Brisbane or Perth running home offices, that visibility can be the difference between a minor scare and a reportable incident under the Notifiable Data Breaches scheme.

The technique matters most when a malicious program refuses to sit still. Many payloads hide by spawning short-lived child processes that drop files, contact a command server, or stage files for encryption. Tracking those children by hand is nearly impossible; Process Monitor turns it into a routine forensic exercise any motivated user can repeat.

What Process Monitor shows about running programs

ProcMon fills the screen immediately with thousands of events. Each row records a process name, PID, operation such as CreateFile or Process Create, path, and result code. The Process Tree view, hidden behind Tools, turns that flat list into a hierarchy where you can expand a parent to see every descendant.

A healthy Windows session in a Melbourne small business shows a tidy tree: explorer.exe spawning your browser, svchost.exe running grouped services, and the usual Office or Adobe updaters chattering quietly. Anything outside that pattern, especially unsigned binaries under AppData or Temp, deserves a closer look. A single malicious parent often creates several identical-looking children, each living only seconds before exiting.

Setting up a filter for suspicious activity

Open the Filter menu and choose Filter… to build a focused view. Keep only Process Create events, then exclude known-good paths like C:\Program Files and C:\Windows. Add an exclusion for your antivirus executable so scans do not pollute the trace. Narrow the Operation column to Process Create and watch the list shrink to something manageable.

Clear the current log with the eraser icon, disable Auto Scroll, then trigger the suspected program by opening a freshly downloaded email attachment. Stop the capture after a few seconds. The filtered window should now contain only the suspicious creations, making patterns in paths and command lines obvious. A user in Adelaide working over NBN will see the same results as a corporate analyst, provided the capture stays tight.

Tracing parent-child relationships in the process tree

Switch to Process Tree and locate the executable you just exercised. Right-click it and choose Stack Summary to understand which DLLs are involved. Expand the children one level at a time, watching for anything that lives only briefly. Process Monitor records the command line of each new process, including hidden PowerShell flags or encoded Base64 strings pointing to script-based payloads.

A common pattern reported to Scamwatch is a legitimate-looking PDF or Word file calling wscript.exe, which then launches a PowerShell child with a long encoded blob. That second child is the actual dropper, and it usually spawns yet another process to inject into before disappearing. Walking the chain from parent to grandchild maps the full kill chain even when the original binary appears harmless.

The table below summarises the most useful event classes when chasing spawned children, and the telltale signs that separate a clean machine from a compromised one.

Operation	What it reveals	Red flag
Process Create	New child spawned by a parent	Unsigned binary from Temp or AppData
Load Image	DLL injected into a running process	DLL named like a system file but in a user folder
CreateFile	File written or locked	New executable dropped into Startup or Run folders
RegSetValue	Registry value added	Run or Scheduled Tasks entry pointing at Temp
TCP Connect	Outbound network activity	Non-browser process in AppData reaching an unknown IP

Once those filters are in place, the event volume becomes manageable and the malicious chain usually jumps out within seconds of triggering it.

Filtering out trusted Windows binaries

Build a second filter that excludes the standard Windows binaries you trust, such as svchost.exe, conhost.exe, and the runtime brokers. Add your own well-known applications, including Outlook, Teams, and the browser you use. The remaining events belong to software that has no business running on a clean workstation.

For analysts in Sydney corporate environments, this step often reveals duplicate child processes mimicking real Microsoft components, such as scvhost.exe or csrs.exe with a swapped letter. Those typosquats are a hallmark of trojanised installers and worm families that spread through infected USB drives. A targeted walk through an email worm cleanup guide can confirm whether you are dealing with a known variant.

Correlating events with network and file behavior

Process Monitor does not capture packets, but its file and registry activity tells you what a process did after contacting the outside world. Look for new entries under Run keys, scheduled tasks in suspicious folders, and executables written into Startup. Those artefacts appear seconds after the malicious parent spawns its first child, giving you a precise timeline to share with responders.

Pair Process Monitor with a packet capture or DNS log if the infection may involve ransomware staging. Identifying the exact second a suspicious process wrote encryption keys lets you isolate the correct restore point or VM snapshot. The ransomware response category on PC Malware Expert tracks emerging families and decryptor availability, shortening recovery once you isolate the offending chain.

Next steps after confirming the threat

With a confirmed child process chain, cleanup becomes much more deterministic. Write down each binary path, hash, and parent PID so nothing is missed, then reboot into a clean environment before deleting. Many persistent payloads cannot be removed while their components are running, so following a Safe Mode deletion workflow is often the safest path on a stubborn Windows 10 or 11 installation.

Once the machine is clean, revisit your defences: tighten macro settings in Office, disable legacy script hosts where possible, and consider application whitelisting if you manage endpoints across locations such as Hobart or Darwin. Process Monitor should remain part of the toolkit for future incidents, ready to expose the next silent child process before it becomes a headline.