w3wp.exe should only run on a windows computer that acts as a web server. One indication of a compromised web server is when w3wp.exe is seen launching a shell, like cmd.exe or powershell.exe. This is common in a webshell attack where an attacker has compromised the web server such that it will remotely run any command provided by the attacker. It typically achieves this by launching a shell to execute the attacker’s command.