I want to be clear, you say - 'cmd popped up twice and shortly afterwards followed a windows update'
Should you have said - 'cmd popped up twice shortly after a windows update' ??
This is important - sometimes a windows update will complete by executing a cmd prompt. That is fine.
But not the other way round - for a cmd box to pop up and do something, followed by what appears to be a windows update would in my opinion, be very suspicious behaviour possibly indicating the installation of malware.