How to Create a Memory Dump File for a Program

A memory dump file is a snapshot of a program’s state at a particular moment. It can help a developer or technical support team investigate why an application froze, crashed, consumed excessive resources, or behaved incorrectly.

To create one in Windows, open Task Manager, find the affected process, right-click it, and select Create memory dump file. Windows will generate a .dmp file and show you where it was saved. The default location for a user-mode Task Manager dump is %LOCALAPPDATA%\Temp.

Creating a dump does not repair the program or free memory. It creates diagnostic evidence that can be examined later. Dump files may also contain sensitive information from the affected application, so they should be handled privately.

What does “Create memory dump file” mean?

The Create memory dump file command tells Windows to copy diagnostic information from a running process into a file.

Depending on the type of dump, that information can include:

• The program’s allocated memory
• Running threads and their call stacks
• Loaded modules and DLL files
• Open handles
• The executable image
• Data needed to reconstruct the process state

A full user-mode dump includes the process’s entire memory space, executable image, handle table, and additional information used by a debugger to reconstruct what the application was doing. Smaller minidumps preserve less information and therefore limit what can be investigated.

The dump is useful when a problem is difficult to reproduce or when a support engineer cannot connect directly to your computer. It allows the program’s state to be inspected after the file has been collected.

It does not:

• Clear the program’s memory
• Free RAM
• Restart the program
• Automatically identify the cause
• Repair the crash
• Convert the application’s memory into readable text

Process dump, live kernel dump, or system crash dump?

These terms are related but not interchangeable.

Windows 11 can create a live kernel dump from the System process without deliberately crashing the operating system. Traditional Windows crash dumps, by contrast, are created after a bug check or Stop error and can be complete, kernel, small, or active dumps.

For an ordinary frozen or crashing application, you usually need a user-mode process dump, not a complete Windows system dump.

How to create a memory dump file with Task Manager

Task Manager is the quickest method when the application is still running.

1. Reproduce the problem

Open the affected program and wait until the issue is visible.

For example:

• Wait until the program stops responding.
• Reproduce the action that causes unusually high CPU usage.
• Wait until memory usage has grown abnormally.
• Leave the application in the incorrect state you want support to investigate.

A dump taken before the problem appears may not contain the useful state.

2. Open Task Manager

Press:

Ctrl + Shift + Esc

You can also right-click the Start button and select Task Manager.

3. Open Processes or Details

Use either the Processes or Details section.

The Details view is often preferable because it shows the executable name and process ID directly.

If the application appears as a grouped entry in Processes, expand the group or switch to Details to identify the correct process.

4. Right-click the affected process

Select the process that belongs to the malfunctioning application.

Do not select an unrelated Windows service merely because it has a similar name.

5. Select Create memory dump file

Right-click the process and choose:

Create memory dump file

Some older Windows interfaces may use the shorter wording Create dump file.

Task Manager supports creating a dump from its process lists so that the result can be analyzed locally or supplied to a software vendor.

6. Wait for the dump to finish

Dump creation can take several seconds or longer. The time depends on:

• How much memory the process is using
• The dump contents
• Available physical memory
• Storage speed
• Available disk space

Do not start several captures simultaneously.

7. Open the saved location

When the dump finishes, Task Manager displays a dialog containing the complete path.

Select Open file location or copy the path before closing the message.

Task Manager normally saves user-mode dumps here:

%LOCALAPPDATA%\Temp

This usually expands to:

C:\Users\<YourUserName>\AppData\Local\Temp

The completion dialog should be treated as the authoritative location because the exact filename can differ.

8. Move the file to a safe working folder

The Temp folder can contain many unrelated files and may be cleaned automatically.

Copy the .dmp file to a clearly named folder such as:

C:\Support\MyApp-Dump

Include the date and a short description of what was happening when you captured it.

When should you create the dump?

The right capture moment depends on the problem.

The program is frozen

Create the dump while Windows still shows the application as Not responding. Do not end the task first.

A dump taken after reopening the application will describe the new working session rather than the frozen one.

CPU usage suddenly becomes very high

Capture the dump while the CPU spike is occurring.

If the spike is too brief to catch manually, use ProcDump with a CPU trigger or ask the vendor what threshold it needs.

The program appears to have a memory leak

Wait until the program’s memory consumption has risen substantially, then capture the dump.

A developer may also request an earlier baseline dump so that the two files can be compared.

The program behaves incorrectly without freezing

Reproduce the incorrect behavior and create the dump before changing screens, closing the dialog, or restarting the program.

The application crashes too quickly

Task Manager cannot dump a process that has already disappeared.

Use one of these instead:

• ProcDump with an exception trigger
• Windows Error Reporting LocalDumps
• The application’s own crash reporter

What to do if Task Manager cannot create the dump

Run Task Manager as administrator

Close Task Manager, search for it from Start, right-click it, and select Run as administrator.

An elevated Task Manager may be required when the target application is also running with administrative rights or belongs to another account.

Microsoft specifically lists insufficient Task Manager privileges as one reason a live dump can fail.

Use the Details section

The app-level entry in Processes may represent several child processes.

Open Details, locate the actual executable, and try again.

Verify that the process is still running

If the application crashed while you were opening Task Manager, its process can no longer be captured manually.

Use automatic crash collection instead.

Wait for another dump to finish

Task Manager can reject a new request while another dump is still being written. Wait for the previous operation to complete before retrying.

Free memory and disk space

Close unrelated applications and verify that the destination drive has adequate free space.

Capturing a large dump temporarily requires memory and storage resources. Microsoft notes that insufficient available memory can cause an incomplete or failed capture.

Retry after a timeout

A timeout does not necessarily mean the process can never be dumped. Wait a few minutes and attempt the capture again.

Use ProcDump

ProcDump is preferable when:

• The problem happens intermittently
• The application crashes too quickly
• You need several dumps
• You need to wait for the process to start
• You need a dump when the application hangs
• You want to trigger capture at a particular condition

How to create a dump with Microsoft ProcDump

ProcDump is a Microsoft Sysinternals command-line utility for creating process dumps manually or in response to conditions such as a hung window, CPU activity, an unhandled exception, or a performance counter threshold.

Download it only from the official Microsoft Sysinternals source and extract it to a local folder.

Create a destination folder first:

mkdir C:\Dumps

Open Windows Terminal or Command Prompt in the ProcDump directory. Administrative rights may be required for an elevated or protected target.

Create a full dump by process ID

First obtain the process ID from Task Manager’s Details section.

Then run:

procdump -ma 4572 C:\Dumps

Replace 4572 with the actual PID.

The -ma parameter requests a full dump containing all process memory and metadata.

Create a dump when the program becomes unresponsive

procdump -ma -h myapp.exe C:\Dumps

Replace myapp.exe with the real executable name.

The -h parameter waits for the process to have a hung window. ProcDump defines a hung window as one that has stopped responding to window messages for at least five seconds.

Create a dump when the program crashes

procdump -ma -e myapp.exe C:\Dumps

The -e parameter captures an unhandled exception.

This is useful when the process exits before you can use Task Manager.

Create several dumps five seconds apart

procdump -ma -n 3 -s 5 myapp.exe C:\Dumps

This requests:

• -n 3: three dumps
• -s 5: five seconds between qualifying captures
• -ma: full dumps

Multiple snapshots can be useful when a program is stuck because developers can compare what its threads were doing over time. Microsoft’s own examples demonstrate capturing three dumps at five-second intervals.

Wait for a process to start

procdump -ma -e -w myapp.exe C:\Dumps

The -w parameter tells ProcDump to wait for the named process to launch.

This is useful when an application crashes immediately after startup.

Common ProcDump parameters

Do not add -k unless you intentionally want ProcDump to terminate the application.

Full dumps can be very large because -ma includes all mapped, private, and image memory, along with process metadata.

How to collect a dump automatically when an application crashes

Windows Error Reporting can be configured to save a dump locally when a particular application crashes.

This is useful when:

• The crash occurs unpredictably
• The process exits instantly
• You cannot leave ProcDump running
• You need Windows to collect the next crash automatically

The feature is called LocalDumps. It is not enabled by default and requires administrator privileges.

Enable a full dump for one application

Open Windows Terminal or Command Prompt as administrator.

Replace myapp.exe with the exact executable name:

reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\myapp.exe" /v DumpType /t REG_DWORD /d 2 /f

Set the maximum number of retained files:

reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\myapp.exe" /v DumpCount /t REG_DWORD /d 10 /f

For DumpType:

• 0 means a custom dump.
• 1 means a minidump.
• 2 means a full dump.

Windows retains up to 10 files by default and replaces the oldest file after that limit is reached.

Where are WER crash dumps saved?

For an ordinary desktop application, the default location is:

%LOCALAPPDATA%\CrashDumps

Services running under system or service accounts can use the corresponding service profile instead.

Disable the per-application configuration

After collecting the required dump, remove the application-specific configuration:

reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\myapp.exe" /f

This prevents Windows from continuing to accumulate full dumps.

LocalDumps might not work for an application that uses its own custom crash-reporting mechanism. In that case, use the application’s crash reporter or ProcDump.

Is an application dump the same as a Windows memory dump?

No.

The phrase “memory dump” can describe several different diagnostic files, which is why many instructions become confusing.

Application or process dump

This captures one running program.

Use it for:

• Application freezes
• Application crashes
• Excessive CPU use
• Memory growth
• Deadlocks
• Incorrect program state

Task Manager, ProcDump, WER, WinDbg, and Visual Studio can all be involved in creating or analyzing process dumps.

Live kernel dump

On supported Windows 11 builds, Task Manager can capture a live kernel dump from the System process without intentionally crashing Windows.

The feature became generally available in Windows OS build 22621.1992 and later. It is intended for kernel, driver, and system-level investigations rather than an ordinary application failure.

System crash or BSOD dump

A system crash dump is produced when Windows encounters a Stop error.

The available system dump types include:

• Complete memory dump
• Kernel memory dump
• Small memory dump
• Active memory dump

A complete system dump can include the contents of physical memory, while a kernel dump excludes memory allocated to user-mode applications. Small dumps retain a limited set of information and are normally saved under %SystemRoot%\Minidump.

Do not deliberately force a Windows crash merely because one application is frozen. A process dump is safer and more relevant unless a qualified support engineer specifically requests a kernel or complete system dump.

How to create a memory dump in Linux

On Linux, a process memory dump is usually called a core dump or core file.

The following methods capture one process. They do not create a forensic image of all physical RAM.

Create a core file from a running process with gcore

First identify the process ID:

pgrep -a myapp

You can also use:

ps -ef | grep myapp

Suppose the PID is 2955.

Run:

sudo gcore -o /tmp/myapp 2955

The resulting file will normally be:

/tmp/myapp.2955

The -o argument specifies the filename prefix, and the PID is appended to it. Unlike a crash-generated core file, the program remains running after gcore finishes.

Use sudo only when you are authorized to inspect that process. A core dump can expose everything the process had loaded into memory.

If gcore is unavailable, install the GNU Debugger package using the package manager for your Linux distribution.

Retrieve a dump from a program that already crashed

Many modern Linux distributions use systemd-coredump.

List recorded crashes:

coredumpctl list

Inspect a particular entry:

coredumpctl info 2955

Export its core file:

sudo coredumpctl dump 2955 -o core.2955

coredumpctl retrieves and processes dumps and metadata saved by systemd-coredump.

On systems using the default systemd handler, the underlying files are commonly maintained under:

/var/lib/systemd/coredump/

Using coredumpctl is usually preferable to opening that directory manually because the command also exposes the associated metadata.

Why is there no core file in the working directory?

The Linux kernel’s core_pattern setting controls the output filename or sends the dump to a user-space handler such as systemd-coredump.

Check it with:

cat /proc/sys/kernel/core_pattern

If the value begins with a pipe character, the kernel is forwarding the dump to another program instead of writing a simple core file in the application directory.

Resource limits, process permissions, security settings, and the distribution’s crash-handling configuration can also prevent a core file from being created.

What does “Create memory dump” mean in Apex Legends?

When Apex Legends displays a crash-reporting window with a Create memory dump option, it is offering to capture diagnostic information about the failed game process.

The button is not a repair function. It creates evidence that may help the support or development team investigate the crash.

When the prompt appears:

1. Select Create memory dump if you plan to report the crash.
2. Wait for the capture to complete.
3. Use Open folder or Copy path if those options are shown.
4. Save the path together with the time of the crash and what you were doing in the game.
5. Submit the file only through an official private support channel.

Because a dump can contain process memory, do not upload it publicly.

What to try after creating the Apex dump

Use the repair or verification function in the launcher through which Apex was installed.

For the EA app:

1. Open Library.
2. Find Apex Legends.
3. Select Manage.
4. Choose Repair.

EA also recommends closing background applications, testing a clean boot, reinstalling the game or EA app when necessary, and trying an FPS cap or V-Sync for persistent crashing or freezing.

You can clear the EA app cache through App Recovery:

1. Open Start.
2. Open All Apps.
3. Expand the EA folder.
4. Select App Recovery.
5. Choose Clear Cache.

The memory dump itself does not prove whether the crash was caused by the game, a driver, an overlay, damaged files, unstable hardware, or another background process. It must be analyzed.

What does “Create memory dump file SF” mean?

In this search query, SF most likely refers to the Special Force game and the error:

Operation failed: Create memory dump file

This is different from deliberately selecting the Task Manager command. It generally means that the game client encountered an error and could not complete its launch or crash-reporting operation.

Because Special Force has different regional publishers and clients, use instructions for your specific regional version.

Try these steps

1. Close the game and its launcher completely.
2. Restart Windows.
3. Confirm that the system drive and game drive have free space.
4. Right-click the official launcher and select Run as administrator.
5. Use the launcher’s repair or update function, if available.
6. Install the latest full client from the official regional publisher.
7. Check whether old .dmp files are accumulating in the game or launcher folder.
8. Move old dump files to a backup folder before retrying.
9. Reinstall the official client if the installation is damaged.
10. Contact the regional publisher and include a screenshot of the exact message.

Official Special Force regional guidance has previously directed affected players to install the current full client, while other regional client guidance has recommended clearing stale DMP files for the “Operation failed: Create memory dump file” condition.

Do not download an unofficial “memory dump fixer.” Do not permanently turn off Windows Security or another antivirus product. If the official publisher confirms that a legitimate game file is being blocked, create the narrowest possible exception for the verified game folder rather than disabling protection system-wide.

How to open and analyze a DMP file

A .dmp file is a binary debugging file. Opening it in Notepad will produce unreadable characters and does not indicate that the file is corrupted.

Open the dump with WinDbg

WinDbg can analyze both user-mode and kernel-mode dumps.

After installing WinDbg:

1. Open WinDbg.
2. Select File.
3. Select Open dump file or Open Crash Dump.
4. Choose the .dmp file.
5. Wait for the initial loading process.
6. Enter this command in the Command window:

!analyze -v

The !analyze extension performs automated initial analysis, and -v requests verbose output.

Open the dump with Visual Studio

In Visual Studio:

1. Select File.
2. Select Open.
3. Select File.
4. Choose the .dmp file.

Visual Studio will open a Minidump File Summary containing available module and debugging information.

Why symbols matter

A debugger needs symbol files to translate memory addresses into meaningful function and source-code information.

Microsoft provides public symbols for Windows components. For a commercial application, however, the required private symbols may only be available to the software developer. Microsoft therefore recommends contacting the manufacturer when application-specific symbols are needed.

This is why ordinary users are often better served by sending the dump to the application vendor instead of attempting a complete analysis themselves.

How to share a memory dump safely

Memory dumps can contain sensitive information because they can include the process’s full memory.

Before sharing one:

1. Confirm that the recipient is the legitimate software vendor or support provider.
2. Place the dump in a clearly named folder.
3. Compress it into a ZIP or 7Z archive.
4. Use the vendor’s private support-ticket attachment system or secure upload portal.
5. Do not attach it to a public forum post.
6. Do not place it in a publicly accessible cloud folder.
7. Delete the local and uploaded copies after the investigation is complete and support confirms they are no longer required.

Include contextual information separately:

• Application name and version
• Windows or Linux version
• Approximate time of the problem
• What you were doing
• Whether the program froze or crashed
• Any visible error code
• Whether the issue is reproducible
• The exact process name that was captured

Frequently asked questions

Is creating a memory dump file safe?

Creating a process dump is a normal diagnostic operation and does not delete the application’s memory. However, the resulting file may contain sensitive data from that process. Store and share it privately.

Does creating a dump stop the program?

Task Manager’s command is a live capture, not the same as End task. The application may become temporarily less responsive while the file is written.

ProcDump also leaves the process running by default. Its -k option explicitly terminates the process after collection, so do not use that parameter unless termination is intended.

Where does Task Manager save memory dump files?

User-mode Task Manager dumps are normally saved under:

%LOCALAPPDATA%\Temp

Task Manager displays the exact filename and location after the operation finishes.

Why is my DMP file so large?

A full dump can include all memory allocated to the process as well as modules, mapped memory, thread data, handles, and debugging metadata. An application using several gigabytes of memory can therefore produce a very large dump.

What is the difference between a full dump and a minidump?

A full user-mode dump includes the process’s entire memory space and extensive process information. A minidump can be much smaller, but its exact contents depend on the options used. A smaller dump may omit the memory needed to investigate the problem.

Use the type requested by the software vendor. When no type is specified and the problem is difficult to reproduce, support teams frequently prefer a fuller dump.

Can I delete a DMP file?

Yes. A dump is not required for Windows or the application to continue operating.

Delete it after:

• You no longer need to analyze it
• The vendor confirms receipt
• The support investigation has finished

Can I open a DMP file in Notepad?

You can technically open it, but the contents will not be meaningful because the file is binary. Use WinDbg, Visual Studio, or the debugger recommended by the software vendor.

Does creating a memory dump fix Apex Legends or another game?

No. It records the game’s state so that the crash can be investigated. Repairing files, removing software conflicts, updating components, or correcting the underlying instability is still necessary.

Which method should you use?

Use Task Manager when the affected Windows application is still running and you need a one-time dump.

Use ProcDump when the problem is intermittent, the program crashes quickly, you need several captures, or you need a hang or exception trigger.

Use Windows Error Reporting LocalDumps when Windows should collect the next application crash automatically.

Use gcore to capture a running Linux process and coredumpctl to retrieve a core dump from a program that already crashed.

Regardless of the method, capture the dump while the problem is present, record what was happening, and share the file only through an authorized private channel.

Production notes

Screenshots that should replace the old assets

1. Task Manager context menu
   • Caption: Select Create memory dump file from the process context menu.
   • Alt text: Create memory dump file option in Windows Task Manager
2. Completed Task Manager dump
   • Caption: Task Manager displays the exact DMP file location after capture.
   • Alt text: Task Manager memory dump file saved location
3. DMP file in the Temp directory
   • Caption: User-mode Task Manager dumps are normally stored in the local Temp folder.
   • Alt text: Memory dump file in Windows AppData Local Temp folder
4. ProcDump full-dump command
   • Caption: ProcDump can capture a full process dump by executable name or PID.
   • Alt text: ProcDump command creating a full memory dump
5. LocalDumps registry configuration
   • Caption: A per-application LocalDumps key enables automatic crash collection.
   • Alt text: Windows Error Reporting LocalDumps registry settings
6. Linux gcore example
   • Caption: gcore creates a core file from a running Linux process.
   • Alt text: Create a memory dump in Linux with gcore
7. coredumpctl output
   • Caption: coredumpctl lists core dumps saved by systemd-coredump.
   • Alt text: Linux coredumpctl list saved core dumps

Suggested internal-link anchors

• how to open DMP files in Windows
• Task Manager not responding
• fix an application that keeps crashing
• troubleshoot high CPU usage
• check which process is using memory
• open Windows Terminal as administrator
• repair corrupted system files
• troubleshoot a Windows blue screen
• find a Linux process ID
• clear the EA app cache

Recommended child articles

The main page should cover the two gaming queries briefly, but these can become standalone pages if demand appears:

• Apex Legends Create Memory Dump Error: What It Means and What to Do
• Special Force Operation Failed: Create Memory Dump File Fix

Those child pages can then link back to this guide for the general explanation of what a dump contains and how it is handled.