There's a couple causes for this but before we go there:
Sometimes malicious actors ("hackers") will disguise processes to be legitimate in order to avoid detection. It has become particularly common over the last couple years with crypto mining. Instead of giving the process a name like "bitcoinminer", they'll disguise it to try and blend in with what you'd expect to see running.
Can you provide the output of `cat /proc/pid/environ`? Make sure to replace pid with the process ID (if not 2397 as you mention you killed it).
Also, can you provide the output of the command `mailq`?