w3wp.exe

by Microsoft

Operating Systemhigh risk

Summary

IIS Worker Process (w3wp.exe) handles web requests for Internet Information Services. Each IIS application pool runs in its own w3wp.exe instance, processing HTTP requests and executing web application code (ASP.NET, PHP, etc.).

w3wp.exe is the 259th most commonly executed Windows program in EchoTrail's dataset, observed 48,841 times across enterprise environments. It typically runs from C:\Windows\System32\inetsrv and it is most often launched by svchost.exe.

259th

most commonly executed Windows program

48,841

observed executions

medium

statistical confidence

Behavior

Top Paths

C:\Windows\System32\inetsrv85.52%
C:\Windows\SysWOW64\inetsrv14.48%

Top Hashes (SHA256)

6cd7cc4b72db91f168c36c500c1be9ae391c1ff09cd65295bb24267d35373fd931.28%
ff11877d711f9de40be231cbadb31453a1896bb2e79d7ea5ff89d9980254ceb428.33%
bbeceb8dbeb159152b1d1b63aa4a23bb97a93ee7e63271213c181d3064f2ddf314.44%
775915a329d8fdb967751d14e8a57e439458b26b26f1ef4fdc6b92e4460646728.88%
1eb51ea7407f41bc212cc699e37727ad6e6d52ec6746119ea066bd901f5e143b6.58%
a0a37fde4d8cd7385e819afa967bc525231c2f166c38591532d8feeab94e40da4.91%
9c4162b129c1750776065a772268ef1292b7cdf51db6b008efbab44d5a12f7a23.14%
064df770a3542eb66c05d44d91826eca61f22f5026b521660653ce52570418621.3%
7243e06fa0183e0c11ed7697d2784502f13b961de572002cd098532d7cd5f3ec0.47%
dc3dfc6c781c36cc042d1b145b995efa69e03bed8a75ad89edeeeca7ac5a8c160.25%

Process Ancestry

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does w3wp.exe normally do?

Located in C:\Windows\System32\inetsrv or C:\Windows\SysWOW64\inetsrv. Launched by svchost.exe (WAS - Windows Process Activation Service). One instance per active application pool. Only runs on machines configured as web servers.

When is w3wp.exe suspicious?

Spawning cmd.exe, powershell.exe, or other shells — primary webshell indicator. Spawning net.exe, whoami.exe, ipconfig.exe (reconnaissance via webshell). Writing files to web-accessible directories (webshell deployment). Making outbound connections to non-standard ports.

How do attackers abuse w3wp.exe?

Webshell execution: after compromising a web application (SQL injection, file upload, deserialization), attackers deploy webshells that execute commands through w3wp.exe. The process tree shows w3wp.exe → cmd.exe → attacker commands. This is one of the most reliable indicators of web server compromise. Exploitation: vulnerabilities in web applications (ProxyShell, ProxyLogon, etc.) result in code execution within w3wp.exe.

Detection guidance

High-confidence: w3wp.exe spawning cmd.exe, powershell.exe, or any shell. w3wp.exe spawning reconnaissance tools (whoami, net, ipconfig, systeminfo). w3wp.exe writing .aspx, .asp, .php, or .jsp files to web directories. This is one of the highest-fidelity detections available — web worker processes should almost never spawn shells. Monitor Sysmon Event ID 1 for w3wp.exe as ParentImage.

False positive notes

Some web applications legitimately spawn processes (e.g., image processing, PDF generation). IIS CGI applications execute through w3wp.exe. However, cmd.exe and powershell.exe as children are almost never legitimate and should always be investigated.

MITRE ATT&CK techniques

T1505.003 T1190 T1059

Related Processes

appcmd.exe cmd.exe powershell.exe svchost.exe

Ask Rocky about w3wp.exe

Rocky answers questions about w3wp.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.