System Thread Exception Not Handled

Home / Minidump analysis

Analyze a minidump for SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

When the blue screen flashes by or names no useful file, the small memory dump still holds the bug check and likely module. This page is the dump → module → next-intent bridge.

First cut You need at least one successful dump after a crash. If dumps are missing, enable writing of small dumps (System Properties → Startup and Recovery) once you can boot, or copy existing .dmp files from another OS / WinRE access to the disk.

Step 1 — Locate minidump files

  1. Path is usually C:\Windows\Minidump\ with names like MMDDYY-nn.dmp.
  2. If Windows will not boot, use WinRE Command Prompt or attach the drive to another PC to copy the folder.
  3. Keep the newest dumps that match the crash times.
File Explorer open to C:\\Windows\\Minidump with a recent .dmp file circled in red
Copy the dump before reinstalling Windows — it is the evidence for the module name.

Step 2 — Open the dump in WinDbg

Microsoft documents kernel-dump analysis with WinDbg. Install WinDbg from Microsoft, set a symbol path (Microsoft public symbols), then:

Third-party “one-click dump readers” are optional convenience only — this guide sticks to WinDbg as documented by Microsoft.

Step 3 — Run !analyze -v

  1. In the debugger command window, run !analyze -v.
  2. Confirm SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) and note Arguments / exception code (often 0xC0000005 access violation).
  3. Read IMAGE_NAME / MODULE_NAME / “Probably caused by” — that string picks the next page.
WinDbg window showing !analyze -v output with SYSTEM_THREAD_EXCEPTION_NOT_HANDLED and MODULE_NAME highlighted by a red box
!analyze names the likely driver — then leave the debugger and fix that branch.

Step 4 — Branch from the module name

nvlddmkm.sys → NVIDIA page
etd.sys → ELAN touchpad
ntoskrnl.exe / ntkrnlmp → ntoskrnl (often still a driver underneath)
Started after Update → after update

Also decode parameters on bugcheck codes. Microsoft’s 0x7E article: use the exception address and !analyze to find the responsible driver.

Branches

No dump files exist Enable small dumps, reproduce once, or use Event Viewer Bugcheck (Event ID 1001) as a weak backup.
Cannot boot to copy dumps boot loop / Safe Mode

FAQ

How do I analyze a minidump file?

Open it in WinDbg and run !analyze -v with symbols loaded. Microsoft Learn covers opening dumps and using !analyze.

Can I delete minidump files?

Yes after you finish analysis — they are crash artifacts. Keep copies while troubleshooting.

WinDbg says probably caused by ntoskrnl.exe — is the CPU dead?

Not necessarily. Microsoft notes ntoskrnl can appear when the real fault is elsewhere; keep reading the stack and IMAGE_NAME, then still test drivers and memory.

Official and primary sources

  1. Microsoft Learn — Analyze a kernel-mode dump with WinDbg
  2. Microsoft Learn — Using the !analyze extension
  3. Microsoft Learn — Bug Check 0x7E
  4. Dell KB — How to read mini dump files (WinDbg)

Symptom map