DFIRHub

Windows event log ยท System7031 Service crashed unexpectedly

  • System
  • 4 fields
  • System.evtx
  • Service Control Manager

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1Name: %ServiceName%
    • %ServiceName% = /Event/EventData/Data[@Name="param1"]
  • PayloadData2It has done this %Count% time(s)
    • %Count% = /Event/EventData/Data[@Name="param2"]
  • PayloadData3The following corrective action will be taken in %Milliseconds% millisecond(s)
    • %Milliseconds% = /Event/EventData/Data[@Name="param3"]
  • PayloadData4CorrectiveAction: %CorrectiveAction%
    • %CorrectiveAction% = /Event/EventData/Data[@Name="param5"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-2664d2012f4}" EventSourceName="Service Control Manager"/>
    <EventID Qualifiers="49152">7031</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2021-02-13 16:46:06.8123462"/>
    <EventRecordID>567985</EventRecordID>
    <Correlation/>
    <Execution ProcessID="224" ThreadID="8252"/>
    <Channel>System</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="param1">State Repository Service</Data>
    <Data Name="param2">1</Data>
    <Data Name="param3">120000</Data>
    <Data Name="param4">1</Data>
    <Data Name="param5">Restart the service</Data>
    <Binary>53-00-74-00-61-00-74-00-65-00-52-00-65-00-70-00-6F-00-73-00-69-00-74-00-6F-00-72-00-79-00-00-00</Binary>
  </EventData>
</Event>
<Event>

References

3 links

Source: evtx/Maps/System_Service-Control-Manager_7031.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)