ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffed818a434fd8, Virtual address for the attempted write.
Arg2: 8a00000000200121, PTE contents.
Arg3: fffff302bef089d0, (reserved)
Arg4: 000000000000000a, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4702
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 9173
Key : Analysis.Init.CPU.mSec
Value: 577
Key : Analysis.Init.Elapsed.mSec
Value: 3948
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: be
BUGCHECK_P1: ffffed818a434fd8
BUGCHECK_P2: 8a00000000200121
BUGCHECK_P3: fffff302bef089d0
BUGCHECK_P4: a
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: explorer.exe
TRAP_FRAME: fffff302bef089d0 -- (.trap 0xfffff302bef089d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=7fffffffffffffff rbx=0000000000000000 rcx=800000000000005a
rdx=3fffffffffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80338552b0a rsp=fffff302bef08b60 rbp=fffff302bef08c49
r8=ffffed8004eb4c30 r9=fffff80338c50bc0 r10=fffff90000000000
r11=fffff302bef08df0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiBuildForkPte+0x62e:
fffff803`38552b0a f0490fba6d183f lock bts qword ptr [r13+18h],3Fh ds:00000000`00000018=????????????????
Resetting default scope
STACK_TEXT:
fffff302`bef087d8 fffff803`38463110 : 00000000`000000be ffffed81`8a434fd8 8a000000`00200121 fffff302`bef089d0 : nt!KeBugCheckEx
fffff302`bef087e0 fffff803`3820ca4f : 8a000000`00200121 00000000`00000003 fffff302`bef08a50 00000000`00000000 : nt!MiRaisedIrqlFault+0x16ccf4
fffff302`bef08830 fffff803`38403c5e : 00000000`00000003 fffff302`bef08b70 00000000`00000000 fffff302`bef08a08 : nt!MmAccessFault+0x4ef
fffff302`bef089d0 fffff803`38552b0a : 00000083`6bc54025 fffff302`00000000 ffff9109`c5e29b00 ffff800f`1ffd2700 : nt!KiPageFault+0x35e
fffff302`bef08b60 fffff803`385539f3 : ffff800f`1ee96340 ffff800f`1ffd2080 fffff93f`fc872b90 ffffed80`04f98a20 : nt!MiBuildForkPte+0x62e
fffff302`bef08c90 fffff803`388d49e1 : ffff800f`1ee96340 fffff302`bef08f99 ffff800f`1ffd2080 ffff800f`1ffd2080 : nt!MiCloneVads+0x4ab
fffff302`bef08f20 fffff803`387f6133 : 00000000`00000000 fffff302`00000000 00000000`00000000 00000000`00000000 : nt!MiCloneProcessAddressSpace+0x261
fffff302`bef09000 fffff803`386f584f : 00000000`00002ab1 fffff302`bef09b80 00000000`00000000 00000000`00000000 : nt!MmInitializeProcessAddressSpace+0x1a7367
fffff302`bef091f0 fffff803`387b8932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspAllocateProcess+0x1c4f
fffff302`bef09760 fffff803`38901445 : ffff362b`8d650908 ffff362b`8d6508a8 00000000`00000000 00000000`00000000 : nt!PspCreateProcess+0x242
fffff302`bef09a30 fffff803`384074b8 : 00000000`00000000 00000000`00000000 00000000`77566d4d fffff302`bef09ae8 : nt!NtCreateProcessEx+0x85
fffff302`bef09a90 00007ff9`2f38cfc4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c8`3491f458 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`2f38cfc4
SYMBOL_NAME: nt!MiRaisedIrqlFault+16ccf4
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 16ccf4
FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}
Followup: MachineOwner
---------