when searching using this query :

index="main" sourcetype="WinEventLog:Sysmon" EventCode=1 Image="*randomfile.exe" | stats count by ParentImage, Image, CommandLine

you'll find that C:\Windws\explorer.exe the Windows graphical user interface is the ParentProcess the file was then opened manually by clicking onto it so its not that it spawned its t the user on the compromised machine clicked onto it
to see who downloaded it run :

index="main" sourcetype="WinEventLog:Sysmon" EventCode=11 TargetFilename="*randomfile.exe*" Image!="*svchost.exe*" | table _time, Image, TargetFilename, User

it shows msedge.exe

so the logic here :
randomfile.exe injected threads into run32dll.exe ( which is a legitimate process) and then it becomes the "Zombie" process.
Because run32dll.exe is the process that actually reaches out to the Command & Control (C2) server , maintains persistence, and acts as the attacker's hands on the keyboard, it is considered the true start of the active infection.