IIS worker process uses w3wp.exe file to process client requests. It is a Windows process which handles requests received by the web server. Each worker process serves for a specific application pool and each application pool has at least one instance of w3wp.exe.
In some cases, w3wp.exe may crash with the error code 0xc0000374 in Event Viewer:
Event ID 1000 Faulting application name: w3wp.exe Faulting module name: ntdll.dll Exception code: 0xc0000374
This issue could be result of the slow performance of an application.
How to fix exception code 0xc0000374
The first step would be running DebugDiag tool to collect crash dump. The crash dump should tell the root cause of the issue. In my case, it was a heap corruption:
To solve a heap corruption, try these:
- It might because of an access violation error. Temporarily disable any antivirus software and monitor the system
- There might be a memory leak due to a logical issue in the application. Do a health check in your application. If you have recently upgraded it, the new version might be causing this issue
- Keep your Windows and third-party software updated
DebugDiag logs provide a valuable information to narrow down the issue. However, some causes such as heap corruptions may require a further analysis. WinDbg is a useful tool to troubleshoot heap corruption issues.
In another case, the stack trace showed MicrosoftInstrumentationEngine_x64 which points a bug. In order to solve this issue, you should uninstall Microsoft Monitoring Agent (SCOM agent) and restart the machine. If you need to install it back, install it by using the command provided by Microsoft:
msiexec /i MonAgent.msi NOAPM=1
Updated Nov 20, 2019
Version 5.0