Memory Forensics Question

I recently had to conduct a compromise assessment on an Windows 10 device. When looking at the processes a flag was raised when wininit.exe had a parent of lsass.exe. My understanding is that wininit.exe has a parent of smss.exe, but smss.exe terminates, so is wininit.exe doesn't have a parent that can be seen. lsass.exe is actual a child of wininit.exe.

I decided to take a look at some other memory dumps that I had lying around. Straight away I found …

computerforensics forensics memory memory forensics