Why would spoolsv.exe legitimately spawn another spollsv.exe.

[Windows 7]

Why would spoolsv.exe legitimately spawn another spollsv.exe. I am a cyber security analyst and we have an alert that triggers often for this situation. Will this happen in an enterprise network where print servers are being used. The first spawn being action by the user and the second by the print server. I have also noticed netconn out to the print servers during this activity. 1 rpc call and then another to a random HEP. My guess is the first netconn is calling out to the print server to establish connection and the second to send the print job.

Continue reading...