ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffc33fff114a68, Virtual address for the attempted write.
Arg2: 0000000100000021, PTE contents.
Arg3: ffff9c8079e39660, (reserved)
Arg4: 000000000000000a, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3249
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 19544
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: rs2_release
Key : WER.OS.Timestamp
Value: 2017-03-17T18:34:00Z
Key : WER.OS.Version
Value: 10.0.15063.0
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: be
BUGCHECK_P1: ffffc33fff114a68
BUGCHECK_P2: 100000021
BUGCHECK_P3: ffff9c8079e39660
BUGCHECK_P4: a
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: SecurityHealthService.exe
TRAP_FRAME: ffff9c8079e39660 -- (.trap 0xffff9c8079e39660)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=8a000001000009e3 rbx=0000000000000000 rcx=0000000000000000
rdx=00007ffe2294d000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000a6a3d51 rsp=ffff9c8079e397f0 rbp=0000000000000100
r8=0000000000000000 r9=00007ffffffeffff r10=0000007ffffffff8
r11=ffffc33fff114a60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiResolveSharedZeroFault+0x1c1:
fffff800`0a6a3d51 48891e mov qword ptr [rsi],rbx ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffff9c80`79e39418 fffff800`0a7ddb61 : 00000000`000000be ffffc33f`ff114a68 00000001`00000021 ffff9c80`79e39660 : nt!KeBugCheckEx
ffff9c80`79e39420 fffff800`0a6a1936 : ffffc300`00000000 ffff9c80`79e39570 00000000`00000003 ffffec00`03000000 : nt!MiRaisedIrqlFault+0xa9e39
ffff9c80`79e39470 fffff800`0a789d72 : 00000000`00003aa1 fffff800`0a991100 00000000`00000000 ffffec00`000afe40 : nt!MmAccessFault+0x1146
ffff9c80`79e39660 fffff800`0a6a3d51 : ffff0430`943354eb 00007ffe`260b5ef4 ffffb206`ec64fb40 ffff9c80`79e39b00 : nt!KiPageFault+0x132
ffff9c80`79e397f0 fffff800`0a6a0dda : ffffb206`ec66ab00 00000000`00000020 ffffb206`ec66ab00 ffff9c80`79e39a10 : nt!MiResolveSharedZeroFault+0x1c1
ffff9c80`79e39910 fffff800`0a789d72 : ffffb206`ebece080 00000000`00000000 00000000`00000000 ffffb206`00000000 : nt!MmAccessFault+0x5ea
ffff9c80`79e39b00 00007ffe`2294dd20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x132
000000cb`172ff590 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`2294dd20
SYMBOL_NAME: nt!MiRaisedIrqlFault+a9e39
MODULE_NAME: nt
IMAGE_VERSION: 10.0.15063.483
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: a9e39
FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault
OS_VERSION: 10.0.15063.0
BUILDLAB_STR: rs2_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}
Followup: MachineOwner
---------
