topic Re: SynRpcServer.exe in System32 folder in Cortex XDR Discussions

SynRpcServer.exe in System32 folder

Panagiss — Wed, 27 Nov 2024 15:31:21 GMT

Hi,

I got an alert "Globally rare process execution from a signed process" and after investigating the process is SynRpcServer.exe

which not uncommon and also the host uses a fingerprint sensor so it should all make sense.

But the interesting parts are on the causality chain are:

SynRpcServer.exe executed "SynRpcServer.exe".
The acting process is signed by Synaptics Incorporated.
This signed vendor, image name and executed process combination is globally uncommon.

Furthermore the location of the exe is in System32 folder:
C:\Windows\System32\SynRpcServer.exe

Hash (of the parent SynRpcServer.exe) 10a416072f3e581e2943f07453c5484e503c47131e48674245564030de2dd531

Any thoughts on this?

Re: SynRpcServer.exe in System32 folder

jmazzeo — Thu, 28 Nov 2024 20:13:43 GMT

Hi @Panagiss, thanks for reaching us using the Live Community.

What module is generating the alert? BTP? Analytics?

Maybe the fingerprint driver/app has been updated and it is behaving different as before.

Re: SynRpcServer.exe in System32 folder

Panagiss — Mon, 02 Dec 2024 08:55:29 GMT

It was from: XDR Analytics BIOC