“DrvInst.exe” is a PE executable located at “%windir%\System32\drvinst.exe”, it is known as “Driver Installation Module”. Since Windows Vista when PnP (Plug and Play) manager detects a new device “DrvInst.exe” is started. It is used for searching and installing the relevant driver for the new device detected (https://learn.microsoft.com/en-us/windows-hardware/drivers/install/debugging-device-installations-with-a-user-mode-debugger).
“DrvInst.exe” can also be used for installing drivers while installing a software package. Let us take for example the installation of “OpenVPN Connect” (https://openvpn.net/client/).
Thus, as with most VPN (Virtual Private Network) solutions there is a need to install a TAP driver, which is a virtual network device (https://www.techradar.com/vpn/what-is-a-tap-adapter). This causes “services.exe” to launch a new process using the following arguments “C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall”, which is part of the “DCOM Server Process Launcher”. It is executed with the permission of the “LocalSystem” user.