I have a habit you might call paranoia: I go hunting through the Task Manager once my computer’s fan starts spinning louder than normal with the aim of “catching the burglar mid-heist.” This habit paid off last week, except this time the “burglar” was a process I’d never questioned before.
Eventually, I realized the bigger problem wasn’t that I didn’t recognize a process. It was that I didn’t have a reliable way to tell whether it deserved my attention.
One process on my list I genuinely couldn’t explain
Its name gave me nothing — the file underneath told a different story
While I scrolled through Process Explorer, the line that caught my attention was RuntimeBroker.exe, PID 18900. This process used about 7.8MB of private memory. Alone, I may not have bothered, but when I saw four additional instances of the same process, I became curious enough to investigate.
They were all running under different PIDs: 18900, 23036, 19616, 20936, and 7104, and they consumed slightly different amounts of memory.
The name itself — “RuntimeBroker” — wasn’t giving me much to work with. In fact, at one point, I was convinced this was the kind of thing a scammer would name a fake process. It sounded both vague and official at once.
So I right-clicked on it and explored its properties. In the Properties window, I could see more than the name gave away, including the executable’s path and its digital-signature information.
It took a few seconds for me to go from hunch to actual answers. This changed how I interact with processes. I didn’t have to recognize every process, but I needed a way to learn more about them.
I turned on a second opinion
Checking a memory VirusTotal already had
By looking through the Company Name column of Process Explorer, I could see that it was signed by Microsoft Corporation. Also, the path showed me that it was running from System32. Those two details made a fake RuntimeBroker much less likely, but I wasn’t ready to settle for “looks fine.”
So, I enabled an extra column. I navigated Options > VirusTotal.com > Check VirusTotal.com, then accepted the one-time terms. In a few seconds, that column populated.
What I liked was that Process Explorer first checked the file’s hash against VirusTotal rather than automatically uploading my copy of the executable. VirusTotal could return an existing result if that hash was already in its database. If a file isn’t already known, Process Explorer also provides an option to submit it for analysis, so I wasn’t treating the integration as a guarantee that files can never leave the PC.
The result for this specific process was 0/76 at the time I checked it. When I clicked its VirusTotal entry, I was taken to a page showing “No security vendors flagged this file as malicious.”
I had assumed that VirusTotal would actually run a live virus scan, but this wasn’t the case. Instead, it queries a large, continuously updated database to see whether that file has been seen before and what vendors reported.
That number wasn’t the answer I thought it was
It only meant something once I stopped reading it alone
When I saw the clean VirusTotal result, I was tempted to treat it as the end of my investigation. A zero-detection result doesn’t prove that a file is safe. It can simply mean that none of the participating engines detected it as malicious, or that the file is too new or unusual for existing signatures and detections to catch.
Also, seeing just one detection inside various engines doesn’t necessarily confirm that it’s malware. A solitary detection can also be a false positive.
Hence, VirusTotal alone wasn’t what settled things for me. I drew conclusions by reading that column and taking into consideration everything that Process Explorer had already shown me. In the case of this specific file, I verified that it sat where a genuine RuntimeBroker should sit and that its digital signature identified Microsoft as the signer. Together, these pieces defined how much I could trust the process.
That way, I was checking whether the path, signer, and VirusTotal result all told the same story.
I still don’t recognize most of what’s running
By the time I closed Process Explorer, I still didn’t know what half the processes actually do day to day on my PC, but I’m ok with it
|
What catches my attention |
What I check next |
|---|---|
|
A process I don’t recognize |
Where its file actually lives |
|
Where its file actually lives |
Who signed it |
|
Still doesn’t add up |
What VirusTotal already knows about it |
|
Several signals pointing the same way |
Worth investigating properly |
svchost.exe made the case for me better than RuntimeBroker.exe did. One instance (PID 1352) used about 20 MB of private memory. It’s one of the most familiar Windows process names, but that familiarity doesn’t tell me which services that particular instance is hosting. The process name alone isn’t enough. Since malware sometimes uses familiar-looking names, it’s important to check where the executable sits on the device and who signed it.
I still don’t recognize many processes, and that’s stopped being my goal. If I don’t recognize something, I now have a way to decide whether it’s worth investigating instead of judging it by the name alone.
Process Explorer gives me several ways to investigate those processes without having to recognize every one of them first.
