Application crash in RPCRT4.dll

MpWazuh 0 Reputation points
2023-08-30T13:27:20.3866667+00:00

Hi!

I've made same question here, but this seems a more technical place.

I'm debugging a crash of an application in Microsoft Windows Server 2019 Datacenter [Ver: 10.0.17763.4131].
This is the basic information

Faulting application name: wazuh-agent.exe, version: 0.0.0.0, time stamp: 0x643571e1

Faulting module name: RPCRT4.dll, version: 10.0.17763.4252, time stamp: 0xa85fd1e2

Exception code: 0xc0000005

Fault offset: 0x000281cb

Faulting process id: 0x93c

Faulting application start time: 0x01d97e69405fd862

Faulting application path: C:\Program Files (x86)\ossec-agent\wazuh-agent.exe

Faulting module path: C:\WINDOWS\System32\RPCRT4.dll

Report Id: 3b1c0bfd-324b-4357-b758-370aee2e848e

Faulting package full name: 

Faulting package-relative application ID:

After analyzing a core dump, we were able to get a backtrace

Entry point	  cryptnet!CryptRetrieveObjectByUrlWithTimeoutThreadProc

Create time	  5/29/2023 5:30:33 AM

Time spent in user mode	  0 Days 0:0:0.15

Time spent in kernel mode	  0 Days 0:0:0.31



rpcrt4!NdrGetBuffer+3b

rpcrt4!NdrAsyncClientCall+1ce

winnsi!RpcNsiRegisterChangeNotification+23

winnsi!NsiRpcRegisterChangeNotificationEx+147

winnsi!NsiRpcRegisterChangeNotification+49

IPHLPAPI!InternalRegisterChangeNotification+7b

IPHLPAPI!NotifyIpInterfaceChange+6e

winhttp!NetworkChangeMonitor::Startup+79

winhttp!StartGlobalNetworkChangeMonitor+4e

winhttp!WxRegisterForNetworkChangeNotification+35

winhttp!InitializeNetworkChangeMonitor+64

winhttp!INTERNET_SESSION_HANDLE_OBJECT::LoadAutomaticProxyResolvers+90

winhttp!INTERNET_SESSION_HANDLE_OBJECT::SetProxySettings+77

winhttp!WinHttpSetOptionInternal+8b1

winhttp!WinHttpOpen+3cd

cryptnet!InetGetBindings+1a

cryptnet!CInetSynchronousRetriever::RetrieveObjectByUrl+160

cryptnet!InetRetrieveEncodedObject+58

cryptnet!CObjectRetrievalManager::RetrieveObjectByUrl+9f

cryptnet!CryptRetrieveObjectByUrlWithTimeoutThreadProc+80

kernel32!BaseThreadInitThunk+19

ntdll!__RtlUserThreadStart+2f

ntdll!_RtlUserThreadStart+1b

But still, it isn't clear why our application is calling this thread.

Is it a know issue related to the library version?

Should we install a specific KB to fix it ?

Thank you.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,165 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 43,946 Reputation points
    2023-09-01T08:03:55.3733333+00:00

    Hello there,

    To understand if this is an known issue you can look into this notification which is regularly update by Microsoft.

    https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-21h2

    This issue is reported here https://support.microsoft.com/en-gb/topic/fix-error-in-rpcrt4-dll-leads-to-intermittent-crashes-when-you-start-a-windows-embedded-compact-7-based-device-cc56d304-bd98-d1db-c48d-492dc31507d6

    If there is a specific program that is causing this issue, try uninstalling and then reinstalling it (eg. Microsoft DirectX, Microsoft Visual C++ Redistributable, NET Framework) to check if it will solve the problem.

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--