Lsass.exe spawning werfault.exe

Hi Folk,

Today i found the suspicious behaviour on two DC's inside the network where, lsass.exe spawned the process of werfault.exe . While doing investigation i was not able to get any artifact that indicates that servers might be compromised. I detected this thing on SIEM and EDR logs doesn't mentions the process lineage. Can you people help me?

computerforensics lsass