Event ID 7034ErrorSystem
Windows Event ID 7034 — Service Crashed Unexpectedly
Logged when a Windows service terminates unexpectedly (not by request).
Why It Matters
Repeated service crashes — especially for security services like Windows Defender, Event Log, or the Security Account Manager — can indicate an attacker killing security tooling or a buggy malicious service.
Key Fields
Service NameThe service that crashed
TimesHow many times the service has crashed
Investigation Tips
- 1.Security-related service crashes (MsMpEng, EventLog, WinDefend) are highest priority — investigate tampering.
- 2.A new service (from 7045) crashing shortly after install may be a poorly written malware persistence mechanism.
- 3.Correlate with 4688 for processes that interacted with the service before the crash.
Go deeper: the full Malicious Service Installation — Persistence via Windows Services guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Malicious Service Installation — Persistence via Windows Services guide →See Event ID 7034 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →