Event ID 7034ErrorSystem
Windows Event ID 7034 — Service Crashed Unexpectedly
Logged when a Windows service terminates unexpectedly (not by request).
Why It Matters
Repeated service crashes — especially for security services like Windows Defender, Event Log, or the Security Account Manager — can indicate an attacker killing security tooling or a buggy malicious service.
Key Fields
Service NameThe service that crashed
TimesHow many times the service has crashed
Investigation Tips
- 1.Security-related service crashes (MsMpEng, EventLog, WinDefend) are highest priority — investigate tampering.
- 2.A new service (from 7045) crashing shortly after install may be a poorly written malware persistence mechanism.
- 3.Correlate with 4688 for processes that interacted with the service before the crash.
Related Event IDs
See Event ID 7034 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects service crashed unexpectedly patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →