Capture a user-mode app dump with Task Manager in Windows 11
Preserve a crashing or hung application state for vendor or debugger analysis without crashing the whole PC.
- Capture the exact app name, version and failure timestamp.
- Prefer a dump from the process while the problem is occurring or immediately before termination when possible.
- Keep Event Viewer/WER information from the same incident.
- Plan a secure storage and sharing path because process memory can contain sensitive application data.
What this problem usually means
Microsoft documents Task Manager support for creating a memory dump of a user-mode process. This preserves process state for detailed analysis without deliberately bugchecking Windows. The dump is evidence for a developer, vendor or experienced debugger; it is not a one-click diagnosis.
What is known, and what is not proven yet
Keep observation, evidence and conclusion separate before making a higher-impact change.
One user-mode process repeatedly fails or hangs.
A process dump captured from the affected application plus matching event/WER timestamp.
The application and its loaded modules/dependencies, not the entire Windows kernel by default.
A repeatable incident, exact application build and analysis by someone able to interpret the dump.
Preserve the dump and incident metadata; avoid broad OS repairs before the app-specific evidence is reviewed.
Application vendor, developer, IT support or experienced debugger.
Work from the narrowest fix to the broader one.
Create the process dump from Task Manager
Low riskWhy this belongs here: Windows can capture the selected user-mode process without intentionally crashing the operating system.
- Open Task Manager and locate the affected process in Processes or Details.
- Right-click the process and choose Create memory dump file.
- Wait for Task Manager to report the saved dump location.
- Copy the dump to a protected working folder without modifying the original.
Package the evidence with the same incident
Low riskWhy this belongs here: A dump becomes much more useful when the analyst knows exactly which failure it represents.
- Record the timestamp, application version and what the user was doing.
- Include matching Event ID 1000/1002 or WER information when present.
- State whether the app crashed, hung, or recovered.
- Send the dump only to the intended vendor/support/debugging recipient.
When this guide stops being the right path
Do not upload process dumps to public forums or treat strings found inside a dump as proof of cause without real debugging context.
If the problem is still not fixed
Use the application vendor, internal IT or qualified debugging path when the dump is needed. If Windows itself is bugchecking, use system crash dumps instead of a user-mode process dump.
Sources reviewed for this page
Primary technical guidance is preferred. A source supports the scope stated here; it does not imply that every possible cause is covered.