Procmon Spawning Endless Processes

jsc.lt 46 Reputation points
2021-01-16T23:20:43.7+00:00

When I launch Procmon it starts to make endless sub-processes of itself. I'm not sure why it takes off like wildfire.

Edition Windows 10 Pro
Version 20H2
Installed on ‎10/‎27/‎20
OS build 19042.746
Experience Windows Feature Experience Pack 120.2212.551.0
Procmon.exe Latest Version

Device name CoffeeLake
Processor Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz 3.60 GHz
Installed RAM 32.0 GB
System type 64-bit operating system, x64-based processor

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,104 questions
0 comments No comments
{count} vote

Accepted answer
  1. mariora 376 Reputation points
    2021-01-17T15:38:55.877+00:00

    When you do batch with Procmon the you realize that Procmon uses DDE to talk to his own different instances, like in this example:

    set PMExe="C:\temp\Procmon.exe"
    %PMExe% /Terminate
    REM *Reset Using Paging File for next usage…
    start "" %PMExe% /PagingFile /NoConnect /minimized /quiet
    %PMExe% /waitforidle
    %PMExe% /Terminate

    So, may be for some reason on your PC DDE has been disabled and the main instance of Procmon cannot communicate with his child and so try again and again and again to start a child instance..
    https://learn.microsoft.com/en-us/security-updates/securityadvisories/2017/4053440#:~:text=To%20disable%20the%20DDE%20feature,automatic%20update%20of%20Workbook%20Links.

    Not sure at all just my thought..

    HTH
    -mario

    0 comments No comments

0 additional answers

Sort by: Most helpful