Application Error

Description

Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.

Message #

Faulting application name: %1, version: %2, time stamp: 0x%3
Faulting module name: %4, version: %5, time stamp: 0x%6
Exception code: 0x%7
Fault offset: 0x%8
Faulting process id: %9
Faulting application start time: %10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Faulting package full name: %14
Faulting package-relative application ID: %15

Fields #

Example Event #

{
  "system": {
    "provider": "Application Error",
    "guid": "",
    "event_source_name": "",
    "event_id": 1000,
    "version": 0,
    "level": 2,
    "task": 100,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-28T19:24:06.1832880+00:00",
    "event_record_id": 306,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "kape.exe",
    "Data_1": "1.3.0.2",
    "Data_2": "89883a17",
    "Data_3": "KERNELBASE.dll",
    "Data_4": "10.0.20348.558",
    "Data_5": "827f29ba",
    "Data_6": "e0434352",
    "Data_7": "000000000001ff6c",
    "Data_8": "17e0",
    "Data_9": "01dceed7707604fd",
    "Data_10": "C:\\Tools\\KAPE\\kape.exe",
    "Data_11": "C:\\Windows\\System32\\KERNELBASE.dll",
    "Data_12": "707434bb-9bd5-4bbf-b8d2-6327601feefc",
    "Data_13": "",
    "Data_14": ""
  },
  "message": "Faulting application name: kape.exe, version: 1.3.0.2, time stamp: 0x89883a17\r\nFaulting module name: KERNELBASE.dll, version: 10.0.20348.558, time stamp: 0x827f29ba\r\nException code: 0xe0434352\r\nFault offset: 0x000000000001ff6c\r\nFaulting process id: 0x17e0\r\nFaulting application start time: 0x01dceed7707604fd\r\nFaulting application path: C:\\Tools\\KAPE\\kape.exe\r\nFaulting module path: C:\\Windows\\System32\\KERNELBASE.dll\r\nReport Id: 707434bb-9bd5-4bbf-b8d2-6327601feefc\r\nFaulting package full name: \r\nFaulting package-relative application ID: "
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Description

Windows cannot access the file FilePath for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program AppName because of this error. Program: AppName File: FilePath The error value is listed in the Additional Data section. User Action 1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again. 2. If the file still cannot be accessed and - It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted. - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer. 3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER. 4. If the problem persists, restore the file from a backup copy. 5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance. Additional Data Error value: StatusCode Disk type: MediumType

Message #

Windows cannot access the file %1 for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program %2 because of this error.

Program: %2
File: %1

The error value is listed in the Additional Data section.
User Action
1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.
2. If the file still cannot be accessed and
	- It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted.
	- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance.

Additional Data
Error value: %3
Disk type: %4

Fields #