Crash Dump Analysis Patterns (Part 289)
Tuesday, March 12th, 2024Sometimes, we are interested in Past Processes, processes that ran in the past to suggest troubleshooting hints. Some may still be present as Zombie Processes and information about some may be present as control areas of the the previously mapped files (even if there are no mapped views at the moment):
1: kd> !memusage
...
Control Valid Standby Dirty Shared Locked PageTables name
…
ffffbe0c8b47f460 0 148 0 0 0 0 mapped_file( WerFault.exe )
…
1: kd> !ca ffffbe0c8b47f460 4
...
\Windows\System32\WerFault.exe
No mapped views.
This analysis pattern is different from Hidden Process where the process is still running or at least its image is still mapped to memory.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -