Event ID 1000ErrorApplication

Windows Event ID 1000 — Application Error

Logged by the Application Error Reporting service when an application crashes with an unhandled exception.

Why It Matters

Repeated crashes of the same application indicate bugs, compatibility issues, or deliberate interference. Crashes of security tools (AV engines, EDR agents) may indicate tampering.

Key Fields

Application NameThe crashing application
Faulting Module NameThe DLL or component that triggered the fault
Exception Code0xc0000005 (access violation) is most common

Investigation Tips

  1. 1.Persistent crashes of security tools warrant investigation for deliberate process termination.
  2. 2.Crashes after software updates are often compatibility issues — check the update timeline.

See Event ID 1000 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →