BSOD issues

Question

BSOD issues happening randomly.

got a few different messages on the blue screens:

MEMORY_MANAGEMENT
ATTEMPTED_WRITE_READONLY_MEMORY

Link to Zipped Memory Dump file https://1drv.ms/u/s!AhRMF3LmiTJIs3GEsp8_6CV1roZ7?e=lZXGqh

3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) An attempt was made to write to readonly memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the BugCheck screen and saved in KiBugCheckDriver. Arguments: Arg1: ffff95018d870ff8, Virtual address for the attempted write. Arg2: 8a00000004d00121, PTE contents. Arg3: ffffdb009c8ad7d0, (reserved) Arg4: 000000000000000a, (reserved)

Debugging Details:

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 3046

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 3053

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 483

Key  : Analysis.Init.Elapsed.mSec
Value: 2800

Key  : Analysis.Memory.CommitPeak.Mb
Value: 88

Key  : Bugcheck.Code.DumpHeader
Value: 0xbe

Key  : Bugcheck.Code.KiBugCheckData
Value: 0xbe

Key  : Bugcheck.Code.Register
Value: 0xbe

Key  : WER.OS.Branch
Value: vb\_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: be

BUGCHECK_P1: ffff95018d870ff8

BUGCHECK_P2: 8a00000004d00121

BUGCHECK_P3: ffffdb009c8ad7d0

BUGCHECK_P4: a

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: svchost.exe

TRAP_FRAME: ffffdb009c8ad7d0 -- (.trap 0xffffdb009c8ad7d0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000100000 rbx=0000000000000000 rcx=0000000000300000 rdx=3fffffffffffffff rsi=0000000000000000 rdi=0000000000000000 rip=fffff80418f53a36 rsp=ffffdb009c8ad960 rbp=ffffdb009c8ada49 r8=ffff9e848c378710 r9=fffff80419650b40 r10=fffff40000000000 r11=ffffdb009c8adbf0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!MiBuildForkPte+0x5fa: fffff80418f53a36 f0490fba6d183f lock bts qword ptr [r13+18h],3Fh ds:0000000000000018=???????????????? Resetting default scope

STACK_TEXT:
ffffdb009c8ad5d8 fffff80418e772a4 : 00000000000000be ffff95018d870ff8 8a00000004d00121 ffffdb009c8ad7d0 : nt!KeBugCheckEx ffffdb009c8ad5e0 fffff80418c39acf : 8a00000004d00121 0000000000000003 ffffdb009c8ad850 0000000000000000 : nt!MiRaisedIrqlFault+0x142e18 ffffdb009c8ad630 fffff80418e0725e : 0000000000000000 0000000000000000 0000000000000000 fffff80418d51a2c : nt!MmAccessFault+0x4ef ffffdb009c8ad7d0 fffff80418f53a36 : 80000084825aa867 ffffdb0000000000 0000000000000000 ffff95000b777050 : nt!KiPageFault+0x35e ffffdb009c8ad960 fffff80418f54953 : ffff9e848c717080 ffff9e848ea9a280 fffff400323627f0 ffff95000b248380 : nt!MiBuildForkPte+0x5fa ffffdb009c8ada90 fffff804192d6381 : ffff9e848c717080 ffffdb009c8add99 ffff9e848ea9a280 ffff9e848ea9a280 : nt!MiCloneVads+0x4ab ffffdb009c8add20 fffff80419200571 : 0000000000000000 ffffdb0000000000 0000000000000000 0000000000000000 : nt!MiCloneProcessAddressSpace+0x261 ffffdb009c8ade00 fffff8041906fd2b : 0000000000002ab1 ffffdb009c8aeb80 0000000000000000 0000000000000000 : nt!MmInitializeProcessAddressSpace+0x192e65 ffffdb009c8adff0 fffff804191c1bc2 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PspAllocateProcess+0x1d13 ffffdb009c8ae760 fffff804193040d5 : ffff6b51da3b0ea2 ffff6b51da3b0f02 0000000000000000 0000000000000000 : nt!PspCreateProcess+0x242 ffffdb009c8aea30 fffff80418e0aab8 : 0000000000000000 0000000000000000 0000000077566d4d ffffdb009c8aeae8 : nt!NtCreateProcessEx+0x85 ffffdb009c8aea90 00007fff391ada64 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x28 000000e85d8ceee8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007fff`391ada64

SYMBOL_NAME: nt!MiRaisedIrqlFault+142e18

MODULE_NAME: nt

STACK_COMMAND: .cxr; .ecxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 142e18

FAILURE_BUCKET_ID: AV_nt!MiRaisedIrqlFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3b24175f-7f5b-9c9f-8aaf-822c248bf0f5}

Followup: MachineOwner

Answer 1

Yes, it is best to test one RAM stick at a time to determine if both are faulty.

Answer 2

Hello,

I ran throught that test, It took almost 12 hours to do 8 passes but the program would not end. and did not save the logs.. it did get something like 2 million errors though.

Would it be worth taking all but 1 stick of ram out and testing each stick individually?

Thanks in advance.

Answer 3

Hi PatrickMoni,

I'm Paul and I'm here to help you with your concern.

"MEMORY_MANAGEMENT" management BSOD error is mostly caused by faulty RAM/Memory.

I recommend that you test the RAM using MEMTest86. Make sure to have at least 8 full passes for a near conclusive result.

Follow the guide from the link below.

https://www.tenforums.com/tutorials/14201-memte...

Let me know the result.

Thanks.

---

Standard Disclaimer: There are links to non-Microsoft websites.

The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.