Years ago I released a tool to create a Windows process with selected parent process: SelectMyParent.
You can not blindly trust parent-child process relations in Windows: the parent of a process can be different from the process that created that process.
Here I start selectmyparent from cmd.exe to launch notepad.exe with parent explorer.exe (PID 328):
Process Explorer reports explorer.exe as the parent (and not selectmyparent.exe):
Process Monitor also reports explorer.exe as the parent:
If we look in the call stack of the process creation of notepad.exe, we see 2 frames (6 and 7) with unknown modules:
We should see entries in the call stack for explorer.exe if notepad.exe was started by explorer.exe, but we don’t.
The <unknown> module is actually selectmyparent.exe.
0x11b1461 is the address of the instruction after the call to _main in ___tmainCRTStarup in selectmyparent.exe.
0x11b12a8 is the address of the instruction after the call to CreateProcessW in _main in selectmyparent.exe.
System Monitor also reports explorer.exe as the parent:
Finally, Volatility’s pstree command also reports explorer.exe as the parent:
Didier Stevens 