ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY is a Windows Blue Screen of Death (BSOD) error associated with the bug check:

0x000000FC

Microsoft defines Bug Check 0xFC as a condition in which Windows detected an attempt to execute code from a memory location marked as non-executable.

In simple terms, Windows divides memory into areas that may contain executable program instructions and areas that should only contain data. If kernel-mode code, frequently because of a defective driver or memory corruption, attempts to execute instructions from a protected non-executable area, Windows stops the operating system to prevent further corruption or a potential security problem.

The blue-screen message may appear as:

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

or:

Stop Code: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

with the corresponding bug check:

0x000000FC

What Does Bug Check 0xFC Mean?

Microsoft documents the four bug-check parameters as follows:

Parameter	Meaning
Parameter 1	Virtual address whose execution was attempted
Parameter 2	Contents of the Page Table Entry (PTE)
Parameter 3	Reserved
Parameter 4	Reserved

For normal users, these hexadecimal values usually aren't directly useful. They become important when an administrator or technician analyzes the crash dump using WinDbg.

Why Does Windows Prevent Execution from Certain Memory Areas?

Modern processors and Windows use memory-protection technologies such as the NX (No Execute) bit and Data Execution Prevention (DEP).

These mechanisms allow memory pages to be marked as non-executable.

For example, a memory area may legitimately contain:

• application data
• driver data
• buffers
• cached information
• kernel data structures

but it should not contain instructions that the CPU executes.

If something unexpectedly redirects execution into such an area, Windows treats it as a serious kernel-level problem.

Instead of continuing and risking system corruption, Windows generates the 0xFC ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY bug check.

Common Causes of ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

There is no single cause of every 0xFC crash. The dump file should ideally be analyzed before replacing hardware or reinstalling Windows.

Common causes include:

1. Faulty or Incompatible Device Drivers

Kernel-mode drivers are among the first things to investigate.

Potential offenders include:

• graphics drivers
• network drivers
• Wi-Fi drivers
• storage/NVMe drivers
• chipset drivers
• USB drivers
• printer drivers
• VPN software
• endpoint-security software
• antivirus drivers
• virtualization software
• motherboard utilities
• hardware-monitoring utilities

Microsoft notes that the responsible driver may appear in the crash information or can often be identified from the stack/current instruction pointer during debugging.

2. Memory Corruption

A component may corrupt kernel memory before Windows actually crashes.

This makes BSOD diagnosis complicated because the component visible at the moment of the crash may be the victim of earlier corruption rather than the actual cause.

Memory corruption can originate from:

• defective drivers
• unstable RAM
• incorrect memory timings
• overclocking
• firmware problems
• hardware instability

3. Faulty RAM

Defective or unstable system memory can corrupt instructions, pointers or kernel structures.

Possible indications include:

• different BSOD codes on different crashes
• random application crashes
• Windows installation failures
• corrupted archives
• browser crashes
• crashes under heavy memory load
• BSODs shortly after enabling XMP/EXPO

Do not automatically assume that 0xFC means defective RAM, however. Software and driver corruption can produce similar symptoms.

4. XMP, EXPO or Memory Overclocking

A memory kit may be advertised for a particular XMP or EXPO frequency, but stability also depends on:

• CPU memory controller
• motherboard
• BIOS version
• DIMM configuration
• number of installed modules
• memory voltage
• timings

Temporarily disabling XMP/EXPO is therefore a useful diagnostic test.

5. CPU or GPU Overclocking

Unstable CPU, GPU or memory overclocking can cause unpredictable memory corruption.

If the error started after tuning the system, return these settings to their defaults:

• CPU multiplier
• CPU voltage
• GPU clock
• GPU memory clock
• RAM timings
• RAM voltage
• XMP/EXPO

Then test the computer again.

6. BIOS/UEFI or Firmware Problems

An outdated BIOS may cause compatibility problems involving:

• newer CPUs
• RAM
• PCIe devices
• NVMe SSDs
• power management
• virtualization
• memory training

Check the computer or motherboard manufacturer's support page for relevant BIOS/UEFI and firmware updates.

Important: BIOS updates should be performed carefully. Interrupting a firmware update can make a computer unbootable.

7. Corrupted Windows System Files

Damaged Windows components can contribute to system instability.

Corruption may result from:

• interrupted Windows updates
• storage errors
• sudden power loss
• improper shutdowns
• malware
• failing storage

Windows includes DISM and System File Checker for repairing operating-system components.

8. Recently Installed Hardware

If the BSOD started after installing new hardware, investigate that change first.

Examples include:

• RAM
• graphics card
• NVMe SSD
• PCIe expansion card
• USB adapter
• Wi-Fi adapter
• capture card
• docking station

Remove the newly added component temporarily and test the computer.

9. Third-Party Antivirus or Security Software

Security software frequently operates at kernel level.

It may install:

• file-system filter drivers
• network-filter drivers
• anti-ransomware drivers
• endpoint monitoring drivers

An incompatible or damaged kernel driver can contribute to BSODs.

If crashes started immediately after installing or upgrading security software, update it first. If necessary, temporarily uninstall it for troubleshooting and rely on Windows' built-in protection while testing.

First Things to Check

Before performing advanced debugging, note what changed immediately before the first crash.

Ask:

• Was a driver updated?
• Was Windows updated?
• Was new RAM installed?
• Was a GPU replaced?
• Was XMP/EXPO enabled?
• Was BIOS updated?
• Was antivirus software installed?
• Was a VPN installed?
• Was virtualization software installed?
• Was a new USB/PCIe device connected?

A recent change is often more useful than randomly replacing components.

Fix 1: Install Windows Updates

Open:

Settings → Windows Update

Select:

Check for updates

Install applicable security, reliability and driver-related updates, then restart Windows.

If the BSOD specifically began immediately after a Windows update, however, investigate that particular update rather than assuming another update will fix the problem.

Fix 2: Update Device Drivers

Do not depend entirely on random third-party "driver updater" utilities.

Prefer drivers from:

1. your computer manufacturer's support website
2. motherboard manufacturer's website
3. GPU manufacturer's official support site
4. hardware manufacturer's support site
5. Windows Update when appropriate

Pay particular attention to:

• chipset
• GPU
• LAN
• Wi-Fi/Bluetooth
• storage controller
• NVMe
• USB
• audio

Restart the computer after major driver changes.

Fix 3: Roll Back a Recently Updated Driver

If the BSOD began after a driver update:

Open:

Device Manager

Locate the device and open:

Properties → Driver

Select:

Roll Back Driver

if available.

Restart and monitor the system.

Fix 4: Reinstall a Suspected Driver

If updating does not help:

1. Open Device Manager.
2. Locate the suspected device.
3. Right-click it.
4. Select Uninstall device.
5. Restart Windows.
6. Install the correct manufacturer-provided driver.

For graphics-driver problems, a clean driver installation may also be useful.

Fix 5: Repair Windows with DISM

Open Windows Terminal or Command Prompt as Administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth

Allow the command to complete.

Do not interrupt it simply because progress appears temporarily stuck.

After DISM finishes, restart the computer or continue with SFC.

Fix 6: Run System File Checker

Open Command Prompt as Administrator and execute:

sfc /scannow

SFC checks protected Windows system files and attempts to repair damaged versions.

After completion, restart Windows.

If SFC repeatedly finds corruption after every reboot, investigate the underlying storage, RAM or system stability rather than repeatedly running SFC.

Fix 7: Test RAM Using Windows Memory Diagnostic

Press:

Windows + R

Enter:

mdsched.exe

Select:

Restart now and check for problems

The computer will restart and test system memory.

A reported memory error should be taken seriously.

For persistent or intermittent problems, a longer dedicated memory test may provide more thorough testing.

Fix 8: Test RAM Modules Individually

If multiple RAM modules are installed, hardware isolation can be extremely useful.

For example, with four modules:

• test module 1
• test module 2
• test module 3
• test module 4

Also test known-good RAM in different motherboard slots when practical.

This can help distinguish between:

• defective RAM
• defective DIMM slot
• memory-controller instability
• incompatible modules

Important: Shut down the computer and disconnect power before physically removing memory.

Fix 9: Disable XMP or EXPO Temporarily

Enter BIOS/UEFI and temporarily disable:

XMP / Intel XMP

or:

AMD EXPO

Run the memory at standard/default settings.

If the BSOD disappears, the previous memory configuration may have been unstable.

This does not necessarily mean the RAM itself is defective.

Fix 10: Remove Overclocking

Restore CPU, GPU and RAM settings to manufacturer/default values.

If you use applications such as motherboard tuning tools or GPU overclocking utilities, disable their automatic profiles as part of the test.

Test Windows under normal settings before proceeding further.

Fix 11: Check Temperatures

Excessive heat can contribute to hardware instability.

Check:

• CPU temperature
• GPU temperature
• motherboard temperature
• SSD/NVMe temperature

Also inspect:

• CPU cooler installation
• fan operation
• dust accumulation
• airflow
• thermal throttling

If crashes occur primarily while gaming, rendering or performing heavy workloads, temperature and power stability deserve additional attention.

Fix 12: Update BIOS/UEFI

Visit your computer or motherboard manufacturer's official support page.

Compare your installed BIOS version with the available versions and read their release notes.

BIOS updates can contain improvements related to:

• CPU microcode
• RAM compatibility
• system stability
• PCIe compatibility
• security
• power management

Do not update BIOS from an unrelated manufacturer's website.

Fix 13: Check SSD/NVMe Health

Storage problems can corrupt operating-system or driver files.

Check the drive's SMART/health status using the SSD manufacturer's diagnostic utility where available.

Also run:

chkdsk C: /scan

This performs an online scan of the Windows volume.

A drive reporting critical SMART warnings, read errors or rapidly increasing media errors should be investigated immediately and important data should be backed up.

Fix 14: Perform a Clean Boot

A clean boot can help determine whether third-party services or startup software contribute to the crash.

Press:

Windows + R

Enter:

msconfig

Under Services:

1. Select Hide all Microsoft services.
2. Disable remaining third-party services for diagnostic testing.

Then disable unnecessary startup applications from Task Manager.

Restart the computer and test.

If the problem disappears, re-enable items gradually until the problematic software is identified.

Fix 15: Boot Windows into Safe Mode

If Windows crashes repeatedly during normal startup, test Safe Mode.

Safe Mode loads a limited set of drivers and services.

If the computer remains stable in Safe Mode but crashes during normal startup, this increases suspicion of:

• third-party drivers
• startup software
• services
• security software
• device-specific software

It does not, by itself, prove which component is responsible.

Finding the Crash Dump

Windows commonly stores small crash dumps under:

C:\Windows\Minidump

Files normally have the extension:

.dmp

A larger dump may also exist as:

C:\Windows\MEMORY.DMP

Crash dumps are among the most useful resources for diagnosing recurring 0xFC errors.

Analyzing ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY with WinDbg

Advanced users and IT administrators can use Microsoft's Windows debugger.

Open the dump file and run:

!analyze -v

Microsoft specifically recommends the !analyze debugger extension for investigating Bug Check 0xFC.

Look for information such as:

BUGCHECK_CODE
MODULE_NAME
IMAGE_NAME
FAILURE_BUCKET_ID
STACK_TEXT
PROCESS_NAME

Microsoft notes that when possible, the responsible driver's Unicode name is saved in KiBugCheckDriver. Otherwise, the stack trace and current instruction pointer can help identify the driver involved.

Example WinDbg Output

You might see something similar to:

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)

BUGCHECK_CODE: fc

MODULE_NAME: exampledriver

IMAGE_NAME: exampledriver.sys

If a third-party .sys file consistently appears across several dumps, identify which hardware or application installed that driver.

Do not simply delete .sys files manually from C:\Windows\System32\drivers.

Instead:

• update the associated application/driver
• roll it back
• uninstall the related software
• obtain a corrected driver from the manufacturer

Do Not Automatically Blame ntoskrnl.exe

Some crash-analysis utilities may show:

ntoskrnl.exe

or:

ntkrnlmp.exe

This does not automatically mean the Windows kernel itself is defective.

The kernel is frequently present at the crash point because it detected or handled the fatal condition.

The actual corruption may have occurred earlier because of a third-party driver or unstable hardware.

Therefore, proper stack and dump analysis is more useful than replacing Windows simply because ntoskrnl.exe appears in a report.

Using Driver Verifier – Advanced Troubleshooting

Windows includes Driver Verifier, which can stress drivers and expose programming errors.

Run:

verifier

However, Driver Verifier should be considered an advanced diagnostic tool.

It can intentionally provoke crashes when a problematic driver violates Windows rules.

Before using it:

• make sure important data is backed up
• know how to enter Safe Mode or Windows Recovery Environment
• create a restore point where appropriate
• ensure you can undo the configuration

To disable Driver Verifier from an elevated command prompt:

verifier /reset

Restart Windows afterward.

Driver Verifier should not be enabled casually on a critical production server or workstation without a recovery plan.

Check Event Viewer

Open:

eventvwr.msc

Navigate to:

Windows Logs → System

Look around the time of the crash for:

• WHEA hardware errors
• disk errors
• storage-controller errors
• driver failures
• unexpected shutdown events

Remember that Kernel-Power Event ID 41 usually tells you that Windows restarted unexpectedly; it does not necessarily identify why the crash occurred.

Scan Windows for Malware

Because kernel-level malware can interfere with system memory and drivers, perform a security scan if there are signs of compromise.

Open:

Windows Security → Virus & threat protection

Run an appropriate scan.

For suspicious systems, Microsoft Defender Offline scanning can provide an additional diagnostic option.

Use System Restore

If the error started after a recent software or driver installation, System Restore may help.

Press:

Windows + R

Enter:

rstrui.exe

Choose a restore point created before the problem started.

System Restore is particularly useful when the exact problematic driver or configuration change is unknown.

When Should You Reinstall Windows?

A Windows reinstall should generally not be the first troubleshooting step.

If the actual problem is:

• defective RAM
• unstable XMP
• failing motherboard
• faulty GPU
• problematic BIOS
• bad storage hardware

reinstalling Windows may not solve anything.

Consider Windows repair/reinstallation only after reasonable driver, memory, firmware and hardware troubleshooting has been completed.

Recommended Troubleshooting Order

For most systems, use this sequence:

Step 1: Record when the BSOD started.

Step 2: Check recent hardware, driver and software changes.

Step 3: Install appropriate Windows updates.

Step 4: Update or roll back relevant drivers.

Step 5: Run DISM.

DISM /Online /Cleanup-Image /RestoreHealth

Step 6: Run SFC.

sfc /scannow

Step 7: Test RAM.

Step 8: Disable XMP/EXPO and overclocking.

Step 9: Check SSD/NVMe health.

Step 10: Check BIOS/UEFI and device firmware.

Step 11: Analyze minidump files.

Step 12: Investigate the driver identified by WinDbg.

Step 13: Perform hardware isolation if crashes continue.

Step 14: Consider Windows repair/reinstallation only after other causes have been reasonably eliminated.

For IT Administrators: What to Collect Before Troubleshooting

For a recurring 0xFC BSOD, collect:

• computer make and model
• motherboard model
• BIOS version
• Windows edition
• Windows build
• CPU model
• RAM capacity
• RAM module configuration
• XMP/EXPO status
• GPU model
• storage model
• recent hardware changes
• recent driver changes
• recent Windows updates
• antivirus/security product
• virtualization software
• VPN software
• C:\Windows\Minidump files
• Event Viewer System log
• WinDbg !analyze -v output

This greatly reduces guesswork.

Frequently Asked Questions (FAQ)

1. What is ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY?

It is a Windows BSOD indicating that code attempted to execute from a memory region that was marked as non-executable.

2. What is the bug check code for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY?

The bug check is:

0x000000FC

Microsoft also refers to it as Bug Check 0xFC.

3. Is ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY caused by RAM?

It can be, but not necessarily.

Faulty or unstable RAM can corrupt memory, but defective device drivers and other kernel-level software are also important causes to investigate.

4. Can a graphics driver cause 0xFC?

Yes. Graphics drivers operate at a low level and can contribute to memory corruption or invalid memory operations if they are defective or incompatible.

5. Can antivirus software cause this BSOD?

Potentially. Antivirus and endpoint-security products often install kernel drivers. A defective or incompatible security driver can contribute to kernel crashes.

6. Should I disable DEP to fix ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY?

Generally, no.

DEP/NX protection is an important security mechanism. Disabling security protections merely to suppress a crash is not a proper fix for the underlying driver or hardware problem.

7. Where are Windows BSOD dump files stored?

Small dump files are commonly located in:

C:\Windows\Minidump

A larger memory dump may be stored at:

C:\Windows\MEMORY.DMP

8. How do I analyze a 0xFC minidump?

Use WinDbg and run:

!analyze -v

Microsoft recommends this debugger extension when investigating Bug Check 0xFC.

9. What does Parameter 1 mean in Bug Check 0xFC?

Parameter 1 represents the virtual address whose execution was attempted.

10. What does Parameter 2 mean?

Parameter 2 contains the relevant Page Table Entry (PTE) contents.

11. Why does WinDbg show ntoskrnl.exe?

The Windows kernel may be shown because it was executing when the corruption was detected. This does not automatically establish that ntoskrnl.exe itself caused the problem.

12. Can XMP cause ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY?

Yes, if the memory configuration is unstable. Temporarily disabling XMP/EXPO is a useful troubleshooting step.

13. Can BIOS cause the 0xFC error?

Firmware bugs or hardware compatibility issues can contribute to system instability, so checking for an appropriate BIOS update is worthwhile, particularly after hardware upgrades.

14. Should I use Driver Verifier?

Only when necessary and preferably when you understand Windows recovery procedures.

Driver Verifier can intentionally trigger BSODs to expose defective drivers.

15. Can I delete the driver mentioned in the dump file?

Do not manually delete driver files from the Windows drivers directory.

Identify the application or hardware associated with the driver and update, roll back or properly uninstall it.

16. Does reinstalling Windows fix 0xFC?

It may help if the underlying cause is severe software or operating-system corruption, but it will not repair defective RAM, unstable overclocking, failing storage or other hardware problems.

17. What if the BSOD happens only while gaming?

Prioritize investigation of:

• GPU driver
• GPU stability
• RAM/XMP stability
• CPU/GPU temperatures
• power supply stability
• chipset drivers
• BIOS

18. What if different BSOD codes appear each time?

Multiple unrelated-looking stop codes can sometimes indicate underlying memory corruption or general hardware instability. RAM testing and dump comparison become particularly important.

19. Can I repair Windows files without reinstalling Windows?

Yes. Start with:

DISM /Online /Cleanup-Image /RestoreHealth

followed by:

sfc /scannow

20. What is the best way to find the actual cause?

Analyzing multiple crash dumps is usually more reliable than analyzing only one.

If the same third-party driver repeatedly appears in several crashes, it becomes a much stronger suspect.

Conclusion

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0x000000FC) is a serious Windows bug check generated when execution is attempted from a memory area that should not contain executable instructions.

The problem should not automatically be classified as "bad RAM." A systematic investigation should consider drivers, memory corruption, RAM stability, XMP/EXPO, BIOS/UEFI, storage, security software and recent hardware or software changes.

For recurring crashes, the most useful evidence is usually the Windows crash dump. Microsoft's documentation specifically points to !analyze and stack/current-instruction analysis as ways to identify the responsible driver.

For business-critical computers, workstations and servers, avoid random driver removal or immediate Windows reinstallation. Collect the dumps, identify patterns, verify hardware stability and address the actual offending component.

#Tags

#ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY #0x000000FC #0xFC #BSOD #BlueScreen #BlueScreenOfDeath #Windows11 #Windows10 #WindowsError #WindowsTroubleshooting #StopCode #WindowsBSOD #MemoryError #MemoryCorruption #RAM #RAMError #FaultyRAM #WindowsMemoryDiagnostic #MemTest86 #DeviceDriver #DriverError #DriverUpdate #DriverVerifier #WinDbg #Minidump #CrashDump #DumpAnalysis #WindowsKernel #KernelError #Ntoskrnl #SystemCrash #WindowsRepair #SFC #DISM #SystemFileChecker #DataExecutionPrevention #DEP #NXBit #BIOS #UEFI #XMP #EXPO #Overclocking #HardwareTroubleshooting #PCRepair #ComputerRepair #WindowsSupport #ITSupport #WindowsTips #TechnicalSupport