ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY problem

[israfileken]

I did the analysis minidump. But ı can't understand what is wrong

Note : Problematic hash ı cannot found in registry



*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffcb885c6f7080, Virtual address for the attempted execute.
Arg2: 8a000001636009e3, PTE contents.
Arg3: ffffb00b71d6b690, (reserved)
Arg4: 0000000000000003, (reserved)

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3421

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-FC7KM9G

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 20905

Key : Analysis.Memory.CommitPeak.Mb
Value: 84

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: fc

BUGCHECK_P1: ffffcb885c6f7080

BUGCHECK_P2: 8a000001636009e3

BUGCHECK_P3: ffffb00b71d6b690

BUGCHECK_P4: 3

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffb00b71d6b690 -- (.trap 0xffffb00b71d6b690)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=ffffb48015f5e180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=ffffcb885c6f7080 rsp=ffffb00b71d6b820 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffcb88`5c6f7080 06 ???
Resetting default scope

BAD_STACK_POINTER: ffffb00b71d6b458

STACK_TEXT:
ffffb00b`71d6b458 fffff802`2284eaa0 : 00000000`000000fc ffffcb88`5c6f7080 8a000001`636009e3 ffffb00b`71d6b690 : nt!KeBugCheckEx
ffffb00b`71d6b460 fffff802`228408a7 : 00000000`00000011 00000000`00000003 00000000`00000000 ffffb00b`71d6b5b0 : nt!MiCheckSystemNxFault+0x1ab7e8
ffffb00b`71d6b4a0 fffff802`226ea6cf : ffffb480`15df51c0 00000000`00000011 ffffb00b`71d6b710 00000000`00000000 : nt!MiRaisedIrqlFault+0x1be95b
ffffb00b`71d6b4f0 fffff802`2280275e : ffffb480`15f5e180 fffff802`227fb7b2 000f8067`b4bbbdff fffff802`00000001 : nt!MmAccessFault+0x4ef
ffffb00b`71d6b690 ffffcb88`5c6f7080 : ffffb480`15f5e180 00000000`ffffffff 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
ffffb00b`71d6b820 ffffb480`15f5e180 : 00000000`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffcb88`5c6f7080
ffffb00b`71d6b828 00000000`ffffffff : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffb480`15f5e180
ffffb00b`71d6b830 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffffff


SYMBOL_NAME: nt!MiCheckSystemNxFault+1ab7e8

MODULE_NAME: nt

IMAGE_VERSION: 10.0.19041.572

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 1ab7e8

FAILURE_BUCKET_ID: 0xFC_STACKPTR_ERROR_nt!MiCheckSystemNxFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {2462e4b8-f7b6-7bb1-7d20-f8e1e8d6795d}

Followup: MachineOwner

Continue reading...