Home
%3CLINGO-SUB%20id%3D%22lingo-sub-326869%22%20slang%3D%22en-US%22%3Ew3wp.exe%20crashes%20periodically%20(Error%200xc0000374)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-326869%22%20slang%3D%22en-US%22%3E%3CP%3EIIS%20worker%20process%20uses%20w3wp.exe%20file%20to%20process%20client%20requests.%20It%20is%20a%20Windows%20process%20which%20handles%20requests%20received%20by%20the%20web%20server.%20Each%20worker%20process%20serves%20for%20a%20specific%20application%20pool%20and%20each%20application%20pool%20has%20at%20least%20one%20instance%20of%20w3wp.exe.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20some%20cases%2C%20w3wp.exe%20may%20crash%20with%20the%20error%20code%200xc0000374%20in%20Event%20Viewer%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EEvent%20ID%201000%0AFaulting%20application%20name%3A%20w3wp.exe%0AFaulting%20module%20name%3A%20ntdll.dll%0AException%20code%3A%200xc0000374%3C%2FPRE%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20638px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71243i30A56CD65CF8E5E1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22iis1.png%22%20title%3D%22iis1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThis%20issue%20could%20be%20result%20of%20the%20slow%20performance%20of%20an%20application.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1764706248%22%20id%3D%22toc-hId-1766523686%22%3EHow%20to%20fix%20exception%20code%200xc0000374%3C%2FH2%3E%0A%3CP%3EThe%20first%20step%20would%20be%20running%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fen-us%252Fdownload%252Fdetails.aspx%253Fid%253D49924%26amp%3Bdata%3D02%257C01%257CNedim.Sahin%2540microsoft.com%257C45496a89e07c490e543e08d685650167%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C636843066190743466%26amp%3Bsdata%3DATpIrfmSZea0pT7w4VuxTEB%252F6gTawk8BbsUYiOJ55H4%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EDebugDiag%3C%2FA%3E%20tool%20to%20collect%20crash%20dump.%20The%20crash%20dump%20should%20tell%20the%20root%20cause%20of%20the%20issue.%20In%20my%20case%2C%20it%20was%20a%20heap%20corruption%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20576px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71245iA0DAF0F4BB947866%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22iis2.jpg%22%20title%3D%22iis2.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20solve%20a%20heap%20corruption%2C%20try%20these%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EIt%20might%20because%20of%20an%20access%20violation%20error.%20Temporarily%20disable%20any%20antivirus%20software%20and%20monitor%20the%20system%3C%2FLI%3E%0A%3CLI%3EThere%20might%20be%20a%20memory%20leak%20due%20to%20a%20logical%20issue%20in%20the%20application.%20Do%20a%20health%20check%20in%20your%20application.%20If%20you%20have%20recently%20upgraded%20it%2C%20the%20new%20version%20might%20be%20causing%20this%20issue%3C%2FLI%3E%0A%3CLI%3EKeep%20your%20Windows%20and%20third-party%20software%20updated%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EDebugDiag%20logs%20provide%20a%20valuable%20information%20to%20narrow%20down%20the%20issue.%20However%2C%20some%20causes%20such%20as%20heap%20corruptions%20may%20require%20a%20further%20analysis.%20WinDbg%20is%20a%20useful%20tool%20to%20troubleshoot%20heap%20corruption%20issues.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

IIS worker process uses w3wp.exe file to process client requests. It is a Windows process which handles requests received by the web server. Each worker process serves for a specific application pool and each application pool has at least one instance of w3wp.exe.

 

In some cases, w3wp.exe may crash with the error code 0xc0000374 in Event Viewer:

 

Event ID 1000
Faulting application name: w3wp.exe
Faulting module name: ntdll.dll
Exception code: 0xc0000374

iis1.png

This issue could be result of the slow performance of an application.

 

How to fix exception code 0xc0000374

The first step would be running DebugDiag tool to collect crash dump. The crash dump should tell the root cause of the issue. In my case, it was a heap corruption:

 

iis2.jpg

 

To solve a heap corruption, try these:

  • It might because of an access violation error. Temporarily disable any antivirus software and monitor the system
  • There might be a memory leak due to a logical issue in the application. Do a health check in your application. If you have recently upgraded it, the new version might be causing this issue
  • Keep your Windows and third-party software updated

DebugDiag logs provide a valuable information to narrow down the issue. However, some causes such as heap corruptions may require a further analysis. WinDbg is a useful tool to troubleshoot heap corruption issues.