Windows 11 BugCheck 1001 error

Question

I encountered a BugCheck 1001 event which created a MEMORY.DMP file and I wanted to gat some assistance on what caused this.

BugCheck 1001 Details:

System
System

-	Provider
--------	--------
-	Provider

			[ Name]	Microsoft-Windows-WER-SystemErrorReporting
			[ Name]	Microsoft-Windows-WER-SystemErrorReporting

			[ Guid]	{abce23e7-de45-4366-8631-84fa6c525952}
			[ Guid]	{abce23e7-de45-4366-8631-84fa6c525952}

-	Provider				[ Name]	Microsoft-Windows-WER-SystemErrorReporting				[ Guid]	{abce23e7-de45-4366-8631-84fa6c525952}

-	Provider
-	Provider

			[ Name]	Microsoft-Windows-WER-SystemErrorReporting
			[ Name]	Microsoft-Windows-WER-SystemErrorReporting

			[ Guid]	{abce23e7-de45-4366-8631-84fa6c525952}
			[ Guid]	{abce23e7-de45-4366-8631-84fa6c525952}

	EventID	1001
--------	--------	--------
	EventID	1001

	EventID	1001

	EventID	1001
	EventID	1001

	Version	1
--------	--------	--------
	Version	1

	Version	1

	Version	1
	Version	1

	Level	2
--------	--------	--------
	Level	2

	Level	2

	Level	2
	Level	2

	Task	0
--------	--------	--------
	Task	0

	Task	0

	Task	0
	Task	0

	Opcode	0
--------	--------	--------
	Opcode	0

	Opcode	0

	Opcode	0
	Opcode	0

	Keywords	0x8000000000000000
--------	--------	--------
	Keywords	0x8000000000000000

	Keywords	0x8000000000000000

	Keywords	0x8000000000000000
	Keywords	0x8000000000000000

-	TimeCreated
--------	--------
-	TimeCreated

			[ SystemTime]	2026-04-26T13:14:55.1699608Z
			[ SystemTime]	2026-04-26T13:14:55.1699608Z

-	TimeCreated				[ SystemTime]	2026-04-26T13:14:55.1699608Z

-	TimeCreated
-	TimeCreated

			[ SystemTime]	2026-04-26T13:14:55.1699608Z
			[ SystemTime]	2026-04-26T13:14:55.1699608Z

	EventRecordID	380238
--------	--------	--------
	EventRecordID	380238

	EventRecordID	380238

	EventRecordID	380238
	EventRecordID	380238

	Correlation
--------	--------
	Correlation

	Correlation

	Correlation
	Correlation

-	Execution
--------	--------
-	Execution

			[ ProcessID]	1136
			[ ProcessID]	1136

			[ ThreadID]	1140
			[ ThreadID]	1140

-	Execution				[ ProcessID]	1136				[ ThreadID]	1140

-	Execution
-	Execution

			[ ProcessID]	1136
			[ ProcessID]	1136

			[ ThreadID]	1140
			[ ThreadID]	1140

	Channel	System
--------	--------	--------
	Channel	System

	Channel	System

	Channel	System
	Channel	System

	Computer	HP840GB
--------	--------	--------
	Computer	HP840GB

	Computer	HP840GB

	Computer	HP840GB
	Computer	HP840GB

-	Security
--------	--------
-	Security

			[ UserID]	S-1-5-18
			[ UserID]	S-1-5-18

-	Security				[ UserID]	S-1-5-18

-	Security
-	Security

			[ UserID]	S-1-5-18
			[ UserID]	S-1-5-18

-	EventData
-	EventData

		param1	0x00000164 (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)
		param1	0x00000164 (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)

		param2	C:\WINDOWS\MEMORY.DMP
		param2	C:\WINDOWS\MEMORY.DMP

		param3	d1529296-da18-4005-8252-b3748a777fa8
		param3	d1529296-da18-4005-8252-b3748a777fa8

Answer 1

1

BugCheck 1001 are just generic errors, and there is no indication in that trace of the underlying cause of the error.

Did this only happen once, or is this a recurring problem and if so, apart from seeing the error in the event viewer, is your Windows system crashing to a black or blue screen with an error code?

2

Please check to see if your PC is producing any minidump files, I will check those to see if they provide any insight into a potential cause of the system crashes.

Please do not upload a very large Memory.dmp file.

Open Windows File Explorer.

Navigate to C:\Windows\Minidump

Copy any minidump files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so I can take a look for you.

Answer 2

Event ID 1001 from source Microsoft-Windows-WER-SystemErrorReporting indicates that Windows Error Reporting logged a system bug check (blue screen) and saved a crash dump.

From the event data provided:

• BugCheck code: 0x00000164
• Parameters: all four parameters are 0x0000000000000000
• Dump file: C:\WINDOWS\MEMORY.DMP
• Event text pattern: matches the generic form:
  “The computer has rebooted from a bugcheck. The bugcheck was: 0xXXXXXXXX (0xX, 0xX, 0xX, 0xX). A dump was saved in: C:\Windows\MEMORY.DMP.”

The WER/SystemErrorReporting event itself does not contain the root cause; it only records that a bug check occurred, its code, and where the dump was written. Determining the exact cause (driver, hardware, or OS component) requires analyzing C:\Windows\MEMORY.DMP with debugging tools (for example, using WinDbg and symbols) to inspect the stack, drivers, and modules involved at the time of the crash.

The event confirms:

• Windows detected a critical system error (bug check 0x164).
• The system rebooted after the crash.
• A kernel memory dump was successfully written to C:\Windows\MEMORY.DMP for further analysis.

To investigate further, the next step is to open that MEMORY.DMP with a debugger and review the call stack, loaded drivers, and any reported faulting module or driver at the time of the bug check.

---

References:

• Troubleshoot unexpected reboots using system event logs
• About WER
• Using WER
• WER Reference