Fix Event ID 1000 Application Error in Windows Event Viewer
Event ID 1000 indicates an application crash. Learn how to read the error details and fix the underlying cause.
Table of Contents
Understanding Event ID 1000
Event ID 1000 is logged in Windows Event Viewer when an application crashes due to an unhandled exception.
To view the error:
1. Press Win + R, type eventvwr.msc, press Enter.
2. Navigate to: Windows Logs > Application.
3. Look for entries with Source: "Application Error" and Event ID: 1000.
The error contains these key fields: - Faulting application name: The program that crashed. - Faulting module name: The DLL that caused the crash (e.g., ntdll.dll, vcruntime140.dll). - Exception code: The type of error (e.g., 0xc0000005 = Access Violation).
Common Faulting Modules and Fixes
ntdll.dll - Core Windows system file. Usually indicates:
- Corrupted system files → Run sfc /scannow
- Incompatible software → Update or uninstall recently installed apps
- Memory issues → Run Windows Memory Diagnostic
kernelbase.dll - Windows kernel library: - Often caused by .NET issues → Repair .NET Framework - Third-party DLL conflicts → Boot in Safe Mode to test
vcruntime140.dll / msvcp140.dll - Visual C++ Runtime: - Reinstall Visual C++ Redistributable 2015-2022
ucrtbase.dll - Universal C Runtime: - Install latest Windows Updates - Reinstall Visual C++ Redistributable
d3d11.dll / d3dx9_43.dll - DirectX: - Reinstall DirectX End-User Runtime
Step-by-Step Troubleshooting
Step 1: Identify the faulting module from Event Viewer.
Step 2: Search for the DLL name on this site to find the appropriate fix.
Step 3: If the faulting module is part of the application itself (not a Windows DLL), try: - Reinstalling the application - Updating the application to the latest version - Running the application as Administrator - Checking for application-specific fixes on the developer's support site
Step 4: If crashes persist, collect a crash dump:
``
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpFolder /t REG_EXPAND_SZ /d "C:\CrashDumps" /f
``
Then analyze the dump with WinDbg.
Common Exception Codes
0xc0000005 - Access Violation The application tried to read/write protected memory. Often caused by corrupted DLLs or incompatible drivers.
0xc000007b - Bad Image Format 32-bit/64-bit mismatch. See our 0xc000007b guide.
0xc0000142 - DLL Initialization Failed A DLL failed to initialize. Usually a runtime library issue.
0xc0000409 - Stack Buffer Overrun Security check detected buffer overflow. Update the application.
0x80000003 - Breakpoint Debug breakpoint hit. May indicate corrupted executable.