Windows 10: BSOD Bug Check - Need help analyzing minidumps

Ever since I installed the Windows 10 1903 update last 6/19/19 my Windows 10 Professional computer has started crashing seemingly at random and always displaying the same BSOD stopCode:

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)


Before I installed the aforementioned update, I never had any BSOD. Now it crashes to the same BSOD about two to four times per day, never explicitly specifying which driver(s) are to blame. The system is so unstable now that I wanted to uninstall update 1903 but apparently it wont let me anymore since more than 10 days have passed since I installed said update. It also seems to have removed my previous System Restore points just like any well designed malware would!


I've been trying to track down the problem by installing WinDbg but unfortunately my knowledge on how to use all its power to find the cause of the problem is very limited.


I have made and uploaded a 7zip archive of the minidumps generated by this issue since the problem started occurring. They can be download from the following link: https://filebin.net/2kf9h3ylqwdasmhg


Next is what I got from WinDbg (X64) by running an "!analyze -v" command on the latest memory dump of the last BSOD I got. Since I have 32 GB of RAM installed, the dmp file is a whopping 18 GB (I set the dump file mode to "Active memory Dump").


1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)

An attempt was made to write to readonly memory. The guilty driver is on the

stack trace (and is typically the current instruction pointer).

When possible, the guilty driver's name (Unicode string) is printed on

the bugcheck screen and saved in KiBugCheckDriver.

Arguments:

Arg1: ffffe880c13bef04, Virtual address for the attempted write.

Arg2: 8a00000000200021, PTE contents.

Arg3: ffffbf054334f720, (reserved)

Arg4: 000000000000000a, (reserved)



Debugging Details:

------------------





KEY_VALUES_STRING: 1



Key : Dump.Attributes.FilterDumpFile

Value: 1





PROCESSES_ANALYSIS: 1



SERVICE_ANALYSIS: 1



STACKHASH_ANALYSIS: 1



TIMELINE_ANALYSIS: 1





DUMP_CLASS: 1



DUMP_QUALIFIER: 402



BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202



SYSTEM_MANUFACTURER: MSI



SYSTEM_PRODUCT_NAME: MS-7976



SYSTEM_SKU: Default string



SYSTEM_VERSION: 1.0



BIOS_VENDOR: American Megatrends Inc.



BIOS_VERSION: 1.L0



BIOS_DATE: 06/28/2018



BASEBOARD_MANUFACTURER: MSI



BASEBOARD_PRODUCT: Z170A GAMING M7 (MS-7976)



BASEBOARD_VERSION: 1.0



DUMP_FILE_ATTRIBUTES: 0x40

Filter Dump



DUMP_TYPE: 0



BUGCHECK_P1: ffffe880c13bef04



BUGCHECK_P2: 8a00000000200021



BUGCHECK_P3: ffffbf054334f720



BUGCHECK_P4: a



CPU_COUNT: 8



CPU_MHZ: fa8



CPU_VENDOR: GenuineIntel



CPU_FAMILY: 6



CPU_MODEL: 5e



CPU_STEPPING: 3



CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)



BLACKBOXBSD: 1 (!blackboxbsd)





BLACKBOXNTFS: 1 (!blackboxntfs)





BLACKBOXPNP: 1 (!blackboxpnp)





BLACKBOXWINLOGON: 1



DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT



BUGCHECK_STR: 0xBE



PROCESS_NAME: System



CURRENT_IRQL: 2



ANALYSIS_SESSION_HOST: DESKTOP-21UNNA0



ANALYSIS_SESSION_TIME: 06-27-2019 08:24:48.0399



ANALYSIS_VERSION: 10.0.18362.1 amd64fre



TRAP_FRAME: ffffbf054334f720 -- (.trap 0xffffbf054334f720)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffe88000000000 rbx=0000000000000000 rcx=ffffe880c13beee0

rdx=00000000000fffff rsi=0000000000000000 rdi=0000000000000000

rip=fffff80373b5cfbc rsp=ffffbf054334f8b0 rbp=0000000000000000

r8=0000000000000000 r9=0000000fffffffff r10=ffffe880013beee0

r11=fffffff000000000 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl zr na po nc

nt!MiUnlinkNumaStandbyPage+0xc8:

fffff803`73b5cfbc 66897924 mov word ptr [rcx+24h],di ds:ffffe880`c13bef04=????

Resetting default scope



LAST_CONTROL_TRANSFER: from fffff80373c4f97d to fffff80373bbc8a0



STACK_TEXT:

ffffbf05`4334f538 fffff803`73c4f97d : 00000000`000000be ffffe880`c13bef04 8a000000`00200021 ffffbf05`4334f720 : nt!KeBugCheckEx

ffffbf05`4334f540 fffff803`73a7ac2a : 8a000000`00200021 00000000`00000003 ffffbf05`4334f680 00000000`00000000 : nt!MiRaisedIrqlFault+0x12a49d

ffffbf05`4334f580 fffff803`73bca79a : 00000000`00000000 ffffbf05`406f79c0 00000000`00000002 fffff803`73e657f8 : nt!MmAccessFault+0x48a

ffffbf05`4334f720 fffff803`73b5cfbc : 00000000`00000000 fffff803`00000001 fffff803`73e65240 fffff803`73e65cc0 : nt!KiPageFault+0x35a

ffffbf05`4334f8b0 fffff803`73b5ccf7 : fffff803`73e65c20 00000000`00000000 ffffe880`013beeb0 00000000`00000f80 : nt!MiUnlinkNumaStandbyPage+0xc8

ffffbf05`4334f8f0 fffff803`73cd7cd8 : 00000000`00000000 ffffe880`013bee80 ffffd680`00000000 00000000`00000000 : nt!MiRemoveLowestPriorityStandbyPage+0x177

ffffbf05`4334f990 fffff803`73cd7ee3 : fffff803`73e65240 00000000`00000000 fffff803`00000000 00000000`0000021e : nt!MiPruneStandbyPages+0x250

ffffbf05`4334fa20 fffff803`73ac4855 : ffffd680`04766040 fffff803`73cd7e50 ffffd68d`25295ce0 fffff803`73e66ee0 : nt!MiRebalanceZeroFreeLists+0x93

ffffbf05`4334fa70 fffff803`73b2f725 : ffffd680`04766040 00000000`00000080 ffffd68d`252ba040 fffff803`00000001 : nt!ExpWorkerThread+0x105

ffffbf05`4334fb10 fffff803`73bc3dfa : ffffac81`39020180 ffffd680`04766040 fffff803`73b2f6d0 00000000`00000000 : nt!PspSystemThreadStartup+0x55

ffffbf05`4334fb60 00000000`00000000 : ffffbf05`43350000 ffffbf05`43349000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a





THREAD_SHA1_HASH_MOD_FUNC: b179561bcb326c8058e5d68c054c098bd7db2d14



THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4b50445c5a1b3919a8b51a86aecd7b0b50a19742



THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c



FOLLOWUP_IP:

nt!MiRaisedIrqlFault+12a49d

fffff803`73c4f97d cc int 3



FAULT_INSTR_CODE: cf8b48cc



SYMBOL_STACK_INDEX: 1



SYMBOL_NAME: nt!MiRaisedIrqlFault+12a49d



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: nt



DEBUG_FLR_IMAGE_TIMESTAMP: 0



STACK_COMMAND: .thread ; .cxr ; kb



IMAGE_NAME: memory_corruption



BUCKET_ID_FUNC_OFFSET: 12a49d



FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault



BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault



PRIMARY_PROBLEM_CLASS: 0xBE_nt!MiRaisedIrqlFault



TARGET_TIME: 2019-06-27T15:19:22.000Z



OSBUILD: 18362



OSSERVICEPACK: 0



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



SUITE_MASK: 272



PRODUCT_TYPE: 1



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



OS_LOCALE:



USER_LCID: 0



OSBUILD_TIMESTAMP: unknown_date



BUILDDATESTAMP_STR: 190318-1202



BUILDLAB_STR: 19h1_release



BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202



ANALYSIS_SESSION_ELAPSED_TIME: 1562



ANALYSIS_SOURCE: KM



FAILURE_ID_HASH_STRING: km:0xbe_nt!miraisedirqlfault



FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}



Followup: MachineOwner

---------

:)

 

BSOD minidump help

I have a new laptop that is experiencing multiple bsod with multiple stopecodes. I have tried every check/upload/download/reinstall/suggestion I can find but still have the problem. I've looked at the minidump but am still clueless as to exactly how to proceed.
If there is anyone that can help analyze the minidump, I would truly appreciate it.

I am including the link to my Onedrive files. Thanks https://1drv.ms/u/s!AvJSnQUPHst5wgsKkLJfNqXfRh0j

 

Help analyze MiniDump

Hi,

can you help me analyze the Minidump file from our client's Laptop.

I have the file , where can i upload it?

thank you

 

Please Help analyze MiniDump Files (included)/BSODs/ ntoskrnl.exe/

Hi,

In most cases, this problem is caused by corrupted system files. For us to provide the best resolution possible, we'll be needing additional information:

• Have you made any recent changes on your computer prior to the issue?
• Was there an error code displayed when experiencing the blue screen error?

Meanwhile, we suggest following the troubleshooting steps provided on this
article to help fix the blue screen error. We also recommend posting on
TechNet forum to analyze the dump files.

If you need further assistance, don't hesitate to reach out.