In the call stack, I see RPC.
…
…
01d3fb5c 7664f4da RPCRT4!DispatchToStubInCNoAvrf+0x4a
01d3fbb4 7664f3c6 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x16c
01d3fbdc 76650cef RPCRT4!RPC_INTERFACE::DispatchToStub+0x8b
01d3fc14 7664f882 RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0xb2
01d3fc60 7664f7a4 RPCRT4!LRPC_SCALL::DispatchRequest+0x23b
01d3fc80 7664f763 RPCRT4!LRPC_SCALL::QueueOrDispatchCall+0xbd
01d3fc9c 7664f5ff RPCRT4!LRPC_SCALL::HandleRequest+0x34f
01d3fcd0 7664f573 RPCRT4!LRPC_SASSOCIATION::HandleRequest+0x144
01d3fd08 7664ee4f RPCRT4!LRPC_ADDRESS::HandleRequest+0xbd
01d3fd84 7664ece7 RPCRT4!LRPC_ADDRESS::ProcessIO+0x50a
01d3fd90 76651357 RPCRT4!LrpcServerIoHandler+0x16
01d3fda0 76e7d3a3 RPCRT4!LrpcIoComplete+0x16
01d3fdc8 76e80748 ntdll!TppAlpcpExecuteCallback+0x1c5
01d3ff30 752f1174 ntdll!TppWorkerThread+0x5a4
01d3ff3c 76eab3f5 kernel32!BaseThreadInitThunk+0xe
01d3ff7c 76eab3c8 ntdll!__RtlUserThreadStart+0x70
01d3ff94 00000000 ntdll!_RtlUserThreadStart+0x1b
kd> !process
PROCESS 85fe7298 SessionId: 0 Cid: 03c0 Peb: 7ffdf000 ParentCid: 0254
DirBase: 3fec91a0 ObjectTable: 94ce8008 HandleCount: 418.
Image: svchost.exe
How do I know, which process generated this RPC? I know it is probably Explorer.exe in this case, but how do I confirm otherwise?
If my question itself is wrong in first place, please do correct and guide me where I went wrong.
I am new to kernel debugging. So please do explain in detail. Thanks.