Application crash in RPCRT4.dll

Question

Hi.

I'm debugging a crash of an application in Microsoft Windows Server 2019 Datacenter [Ver: 10.0.17763.4131].
This is the basic information

Faulting application name: wazuh-agent.exe, version: 0.0.0.0, time stamp: 0x643571e1

Faulting module name: RPCRT4.dll, version: 10.0.17763.4252, time stamp: 0xa85fd1e2

Exception code: 0xc0000005

Fault offset: 0x000281cb

Faulting process id: 0x93c

Faulting application start time: 0x01d97e69405fd862

Faulting application path: C:\Program Files (x86)\ossec-agent\wazuh-agent.exe

Faulting module path: C:\WINDOWS\System32\RPCRT4.dll

Report Id: 3b1c0bfd-324b-4357-b758-370aee2e848e

Faulting package full name:

Faulting package-relative application ID:

After analyzing a core dump, we were able to get a backtrace

Entry point cryptnet!CryptRetrieveObjectByUrlWithTimeoutThreadProc

Create time 5/29/2023 5:30:33 AM

Time spent in user mode 0 Days 0:0:0.15

Time spent in kernel mode 0 Days 0:0:0.31rpcrt4!NdrGetBuffer+3b rpcrt4!NdrAsyncClientCall+1cewinnsi!RpcNsiRegisterChangeNotification+23winnsi!NsiRpcRegisterChangeNotificationEx+147winnsi!NsiRpcRegisterChangeNotification+49IPHLPAPI!InternalRegisterChangeNotification+7bIPHLPAPI!NotifyIpInterfaceChange+6ewinhttp!NetworkChangeMonitor::Startup+79winhttp!StartGlobalNetworkChangeMonitor+4ewinhttp!WxRegisterForNetworkChangeNotification+35winhttp!InitializeNetworkChangeMonitor+64winhttp!INTERNET_SESSION_HANDLE_OBJECT::LoadAutomaticProxyResolvers+90winhttp!INTERNET_SESSION_HANDLE_OBJECT::SetProxySettings+77winhttp!WinHttpSetOptionInternal+8b1winhttp!WinHttpOpen+3cdcryptnet!InetGetBindings+1acryptnet!CInetSynchronousRetriever::RetrieveObjectByUrl+160cryptnet!InetRetrieveEncodedObject+58cryptnet!CObjectRetrievalManager::RetrieveObjectByUrl+9fcryptnet!CryptRetrieveObjectByUrlWithTimeoutThreadProc+80kernel32!BaseThreadInitThunk+19ntdll!__RtlUserThreadStart+2f**ntdll!_RtlUserThreadStart+1b

But still, it isn't clear why our application is calling this thread.

Is it a know issue related to the library version?

Should we install a specific KB to fix it ?

Thank you.

Answer 1

The forum does not have the relevant permissions to analyze your Dump file. If you really need to provide relevant support, it is recommended to contact Microsoft online support engineers:

Global Customer Service phone numbers - Microsoft Support

Answer 2

I just wanted to get more information about the call stack I extracted from the Dump file.

Here I can see at least three questions in "answers.microsoft.com" that are about Dumps files

https://answers.microsoft.com/en-us/windows/forum/all/i-need-help-analyzing-a-dump-file/5d6c0dae-aad3-4ebd-8cb6-6d7fefedaa4a?from=ContactUsWebBCQR&CorrelationId=97398340-ef0a-463f-9923-5e07d9f0b2e4

https://answers.microsoft.com/en-us/windows/forum/all/need-help-analysing-dump-files-on-windows-11/1d3580d1-ed9e-443f-b163-1792ce657a39?from=ContactUsWebBCQR&CorrelationId=97398340-ef0a-463f-9923-5e07d9f0b2e4

https://answers.microsoft.com/en-us/windows/forum/all/need-help-analyzing-a-minidump-file-for-a-strange/bc763d09-1433-4bfb-840c-b41202790d35?from=ContactUsWebBCQR&CorrelationId=97398340-ef0a-463f-9923-5e07d9f0b2e4

Regards.

Answer 3

The forum cannot analyze your dump file, so it cannot extract more information about the call stack.

Answer 4

The forum cannot analyze your dump file, so it cannot extract more information about the call stack.

I've already analyzed it.
Let me copy again here the call stack I've asking about since the beginning of the post.
I was wondering if someone could help me to understand why our program ends up calling these methods

rpcrt4!NdrGetBuffer+3b rpcrt4!NdrAsyncClientCall+1cewinnsi!RpcNsiRegisterChangeNotification+23winnsi!NsiRpcRegisterChangeNotificationEx+147winnsi!NsiRpcRegisterChangeNotification+49IPHLPAPI!InternalRegisterChangeNotification+7bIPHLPAPI!NotifyIpInterfaceChange+6ewinhttp!NetworkChangeMonitor::Startup+79winhttp!StartGlobalNetworkChangeMonitor+4ewinhttp!WxRegisterForNetworkChangeNotification+35winhttp!InitializeNetworkChangeMonitor+64winhttp!INTERNET_SESSION_HANDLE_OBJECT::LoadAutomaticProxyResolvers+90winhttp!INTERNET_SESSION_HANDLE_OBJECT::SetProxySettings+77winhttp!WinHttpSetOptionInternal+8b1winhttp!WinHttpOpen+3cdcryptnet!InetGetBindings+1acryptnet!CInetSynchronousRetriever::RetrieveObjectByUrl+160cryptnet!InetRetrieveEncodedObject+58cryptnet!CObjectRetrievalManager::RetrieveObjectByUrl+9fcryptnet!CryptRetrieveObjectByUrlWithTimeoutThreadProc+80kernel32!BaseThreadInitThunk+19ntdll!__RtlUserThreadStart+2f**ntdll!_RtlUserThreadStart+1b

Answer 5

I apologize, but I've run out of ideas and am unsure of any other possibilities.

in order to be able to get a quick and effective handling of your issue, I recommend that you repost your question in Stack Overflow or Microsoft Q&A, they are designed for developers.

Thank you for your understanding and support.