Log Dejargonizer

Windows Application Log · Event 1000

Event 1000: An application crashed

A program stopped working. The event names the crashing program, the component it died inside, and the exception code — and the faulting module is usually the field that identifies the real culprit rather than the application you were using.

Also written as Application Error 1000Event ID 1000Faulting application nameapp crash event id

What it means for you

On a personal computer

A program crashed. The important line is the faulting module — that is the specific file that failed, and it is often not the program you were running. If it names a graphics driver or an add-on, that is what needs updating.

For an analyst

Group by faulting module rather than by application when triaging fleet-wide; a single bad shell extension or driver produces crashes across many unrelated programs. The exception code separates access violations from stack overflows from managed exceptions, which changes the investigation entirely.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Faulting application name: notepad.exe, version: 10.0.19041.1, time stamp: 0x00000000
Faulting module name: ntdll.dll, version: 10.0.19041.1, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x000000000004f1c2
Faulting process id: 0x1cf4
Faulting application start time: 0x01dcf000a1b2c3d4
Faulting application path: C:\Windows\System32\notepad.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 0a1b2c3d-0000-0000-0000-00000000abcd

The fields that decide it

Everything else in the log line is context.

Faulting application name
The program that crashed, with its version and timestamp.
Faulting module name
The component it crashed inside. This is the field that usually identifies the cause.
  • The same name as the applicationThe program crashed in its own code. A bug in that software.
  • ntdll.dllA generic Windows component, which usually means the real fault is elsewhere — often memory corruption or a third-party add-on.
  • KERNELBASE.dllTypically a managed or unhandled exception surfacing here rather than a fault in the file itself.
  • A graphics driver fileA display driver fault. Update or roll back the driver.
  • An unfamiliar third-party DLLA shell extension, add-on, or injected component. Frequently the actual culprit.
Exception code
The kind of fault.
  • 0xc0000005Access violation — the program touched memory it should not have. The most common by a wide margin.
  • 0xc0000374Heap corruption. Often caused by a component other than the crashing program.
  • 0xe0434352An unhandled .NET exception. The application's own logs will say more than this event does.
  • 0xc00000fdStack overflow, typically runaway recursion.
  • 0x80000003A breakpoint, which usually means a debug build or something attached to the process.
Fault offset
Where inside the module the crash happened. Only meaningful with symbols, but a consistent offset across crashes confirms they share one cause.
Report Id
Links the event to the Windows Error Reporting record and any dump file that was written.

Ordinary reasons this happens

Most of the time it is one of these.

  • An ordinary software bug in the application itself.
  • An outdated add-on, plugin, or extension conflicting with a program.
  • A graphics driver fault, which typically crashes several visually intensive applications rather than one.
  • A program running out of memory on a heavily loaded machine.
  • A partially completed software update leaving mismatched files.

When it is not ordinary

Code injected into a legitimate process destabilising it.

What gives it awayCrashes in a normally stable application with an unfamiliar faulting module, particularly one loaded from a user or temp directory.

ATT&CK T1055

An exploit attempt that failed.

What gives it awayRepeated access violations in an application that handles untrusted input — a browser, a document reader, a network service — often at a consistent fault offset.

ATT&CK T1203

Security software being destabilised deliberately.

What gives it awayRepeated crashes of an antivirus or EDR component, especially alongside other unusual activity on the host.

ATT&CK T1562.001

What to do next

  1. Read the faulting module before the application name. It is more often the cause.
  2. Check whether the module belongs to the application, to Windows, or to something third-party.
  3. Note the exception code — an access violation and a .NET exception need completely different investigations.
  4. Check whether the same module crashes multiple different applications. If so, that module is the problem.
  5. Look for a matching Event 1001 from Windows Error Reporting, which points at the dump file.
  6. Try the application with add-ons disabled, or in safe mode, to isolate a third-party component.

Queries to run

powershell Filter by provider as well as ID — several sources write an Event 1000 into the Application log. 
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Error'; Id=1000} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-List
kql Grouped by faulting module. A module crashing many different applications is the one to fix. 
Event | where EventLog == 'Application' and Source == 'Application Error' and EventID == 1000 | extend App = extract(@'Faulting application name: (\S+)', 1, RenderedDescription), Module = extract(@'Faulting module name: (\S+)', 1, RenderedDescription) | summarize crashes = count(), apps = dcount(App) by Module | order by crashes desc
splunk 
index=wineventlog sourcetype=WinEventLog:Application EventCode=1000 | rex "Faulting module name: (?<module>\S+)" | stats count dc(host) as hosts by module | sort -count

Common questions

What does exception code 0xc0000005 mean?

An access violation — the program tried to read or write memory it was not allowed to touch. It is by far the most common application crash, and it usually means a bug in the faulting module rather than anything about your machine. If it repeats in the same module, that module is what needs updating or removing.

The faulting module is ntdll.dll. Is Windows broken?

Almost never. ntdll.dll is a core Windows component that nearly everything calls, so faults frequently surface there even when the real cause is elsewhere — commonly memory corruption caused by a third-party add-on or shell extension. Look at which applications are crashing and what they have in common rather than at ntdll itself.

How do I find out why a program keeps crashing?

Read the faulting module name in the event; it is the specific file that failed. If it belongs to the application, look for an update from its vendor. If it is a third-party DLL, try the program with add-ons disabled. If it is a driver file, update or roll back that driver. The Report Id also links to a dump file, if one was written, which will name the exact function.

What is the difference between Application Error 1000 and BugCheck 1001?

1000 in the Application log means one program crashed while Windows kept running. 1001 in the System log, from the WER-SystemErrorReporting provider, means the whole machine blue-screened. They share a number but nothing else, so always check which log and which provider you are looking at.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026