Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Diagnostics & reliability · reviewed troubleshooting

Application keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module

Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.

Applies to: Windows 11Change risk: LowReviewed: 2026-09-17
Do this first
  1. Reproduce the crash once and note the exact time.
  2. Open Event Viewer > Windows Logs > Application and find matching Event ID 1000/1001 records.
  3. Preserve the faulting application, faulting module and exception code.
  4. Check Reliability Monitor for the same crash and the date the pattern began.

What this problem usually means

Microsoft’s current application/service crash guidance says repeated Application Error Event ID 1000 and Windows Error Reporting Event ID 1001 indicate application-crashing behavior. The useful evidence is the repeated process, faulting module, exception code, report context and whether the crash belongs to a Microsoft or third-party component.

Ordered repair path

Work from the narrowest fix to the broader one.

1

Confirm the crash signature repeats

Low risk

Why this belongs here: One unrelated Application Error is weak evidence; repeated matching process/module/error data is much more useful.

  1. Compare two or more crash timestamps when available.
  2. Check whether the same application and module recur.
  3. If a third-party module consistently appears, use that product’s repair/update path first.
  4. If the failure started immediately after an app or driver update, preserve that chronology before changing multiple components.
2

Collect a dump only when normal repair cannot explain the crash

Low risk

Why this belongs here: Microsoft’s crash guidance uses debugging data when repeated Event 1000/1001 evidence is insufficient.

  1. Preserve any existing application crash dump or WER report.
  2. Avoid deleting logs/dumps before analysis.
  3. For repeatable high-impact crashes, move to supported dump collection/debugging rather than guessing from a DLL name alone.
Stop condition

When this guide stops being the right path

Do not reinstall Windows or declare the faulting DLL defective merely because its name appears in Event ID 1000. A module can be where the crash surfaced without being the original cause.

If the problem is still not fixed

If the crash belongs to a service, combine the Application log with Service Control Manager events. If the whole PC crashes, use stop-code/memory-dump evidence instead of app-crash records.

Evidence

Sources reviewed for this page

Primary technical guidance is preferred. A source supports the scope stated here; it does not imply that every possible cause is covered.

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

ErrorEvent ID 1000 — Application Error: application or service crash record

Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.

ErrorEvent ID 1002 — Application Hang: the app stopped interacting with Windows

Treat Application Hang evidence as proof of a non-responsive process state, then correlate the process, report ID, wait chain and WER record before assigning cause.

GuideUse Windows Error Reporting evidence to separate app crashes from app hangs

WER can preserve report identifiers and crash/hang context that help connect an incident to the correct process without turning every report into a root-cause claim.

GuideFind repeated app crashes with Reliability Monitor before reinstalling everything

Use the Windows reliability timeline to identify when failures began and whether they line up with a specific app, driver, update or installation.

CommandPowerShell — list WER report archive

List recent Windows Error Reporting archive directories so report timing can be correlated with an application crash or hang without deleting or changing the reports.

GuideApplication not responding in Windows 11: inspect the wait chain before forcing repairs

A hung app may be waiting on another process, service or resource. Preserve the process and dependency evidence before reinstalling Windows or killing unrelated tasks.