You may be requested to create a dump file if an application or Windows freezes.  There are two types of dump files:


Application Dump files - these are a copy of the applications memory.  These dumps are created from Task Manager.  These are typically created when an application freezes, but the rest of the operating system is still responsive.


Kernel Dump Files - there are a copy of the Windows memory.  These dumps are created when Windows crashes. Kernel dumps are typically used when Windows completely freezes


Create Application Dump Files


First you need to determine if the application is 32bit or 64bit:


  1. Open task manager
  2. Click on processes
  3. Find the application


If it has the application name followed by (32 bit), the application is a 32 bit application.  Otherwise it is a 64 bit application.


Create a 32 bit Application Dump File


  1. Open Task Manager from C:\Windows\SysWOW64\taskmgr.exe
  2. Find the application 
  3. Right mouse click and select "Create dump file"
  4. Put the dump file on a cloud drive and send the link to tech support



Create a 64 bit Application Dump File


  1. Open Task Manager
  2. Find the application 
  3. Right mouse click and select "Create dump file"
  4. Put the dump file on a cloud drive and send the link to tech support



Creating a Kernel Dump File

If Windows is hanging you need to create a Kernel Dump File.  To do this, you need to define a keystroke that will cause Windows to crash and create a dump file.  From the article:  

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard


1. Follow this article to enable Kernel Mode dump file:  https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file


2. Follow this article to set up a keystroke to force the system to crash when frozen:  https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard


Once this is setup, the next time the system freezes, press the keystroke as defined in the above article and it will for the system to crash and create a kernel crash dump file.


Upload the kernel crash dump file to cloud storage and send the link to tech support.



Analyzing Kernel Dump Files


Download WinDbg:  https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
Start WinDBG, FIle -> Open Crash Dump
Load the MEMORY.DMP file
At the bottom, enter the command:  
      !locks   

This will show all the threads that are locked at the time of the crash dump.  The locked thread IDs look like the following.  There will be several duplicates.

     Threads: ffffb003de9a3080-01

The thread ID, is the "ffffb003de9a3080" part.  To find the process for the thread enter the command:
    !thread ffffb003de9a3080 

This will list the process and a stack dump of the windows operating system calls.  The bottom of the stack dump "call site" is the highest call.  As you look through the stack dump you can get a feel for what the process was trying to do when it got locked.