w3wp.exe crash caused by Heap Corruption (0xC0000374)

IIS uses worker process (w3wp.exe) to work on requests from clients. Because of a variety of reasons, w3wp.exe may crash which makes the web application unresponsive. Heap Corruption (0xC0000374) is one of the common causes of w3wp.exe crashes. You will find the solution here for an issue caused by a specific bug in System Center Operations Manager.

In the case I worked on, w3wp.exe was crashing every a few minutes. Here is a sample Event Viewer log:

Event ID 1000 – Application Error

Faulting application name: w3wp.exe
Faulting module name: mscorwks.dll
Exception code: 0xc0000005

w3wp.exe crash log
w3wp.exe crash log

Root Cause of the w3wp.exe crash

Upon checking the dump file we collected using DebugDiag crash rule, we saw heap corruption.

In w3wp__SharePoint_PID.dmp the assembly instruction at ntdll!RtlReportCriticalFailure+62 in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused a corrupted heap exception (0xC0000374) when trying to perform an unknown operation on memory location 0x00000000 on thread 105

Heap corruption was detected in w3wp__SharePoint_PID.dmp. However page heap was not enabled in this dump. Please follow the instructions in the recommendation section for troubleshooting heap corruption issues.

Current NTGlobalFlags value: 0x0

An exception thrown by a heap memory manager function indicates heap corruption. Please click the ‘PageHeap Flags…’ button in the DebugDiag crash rule configuration dialog to enable PageHeap for the target process and collect another dump. For more information, review the following documents:
How to Use the Debug Diagnostic Tool v1.1 (DebugDiag) to Debug User Mode Processes
Debugging Heap corruption with Application Verifier and Debugdiag

Heap corruption
Heap corruption

The stack trace showed MicrosoftInstrumentationEngine_x64 which points out the bug mentioned here.

Stack trace:


Solution for w3wp.exe crash caused by Heap Corruption

In order to solve this issue, you should uninstall Microsoft Monitoring Agent (SCOM agent) and restart the machine.

If you need to install it back, install it by using the command provided by Microsoft:

msiexec /i MonAgent.msi NOAPM=1

If this doesn’t solve the issue, please check this post out for other possible reasons of w3wp.exe crashes: 0xc0000005 exception code causes w3wp.exe crashes.

Corruption of the heap may occur because of issues other than the bug I mentioned above. Here is a good post about other root causes: w3wp.exe crashes every 5 minutes with error code 0xc0000374

Leave a Comment