Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Windows command reference

Task Manager — Create memory dump file

Capture a memory dump of one user-mode process so its state can be analyzed or provided to a support vendor without deliberately crashing Windows.

Risk: LowReviewed: 2026-09-17
Task Manager > Processes/Details > right-click process > Create memory dump file

When to use it

Use for a reproducible application crash or hang when normal Event Viewer/WER evidence is not enough and a vendor, developer or debugger requests process state.

When not to use it

Process dumps can contain sensitive in-memory data. Do not publish them openly, and do not confuse a user-mode process dump with a Windows kernel crash dump.

Primary reference

Reviewed source

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

GuideCapture a user-mode app dump with Task Manager in Windows 11

Preserve a crashing or hung application state for vendor or debugger analysis without crashing the whole PC.

CommandTask Manager — Analyze wait chain

Display whether a running process is waiting on another process or resource, which can help explain a Not responding state without modifying Windows configuration.

GuideApplication not responding in Windows 11: inspect the wait chain before forcing repairs

A hung app may be waiting on another process, service or resource. Preserve the process and dependency evidence before reinstalling Windows or killing unrelated tasks.

CommandPowerShell — list WER report archive

List recent Windows Error Reporting archive directories so report timing can be correlated with an application crash or hang without deleting or changing the reports.

GuideApplication keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module

Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.

ErrorEvent ID 1000 — Application Error: application or service crash record

Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.