.dmp file for the person investigating the failure.Microsoft’s current Task Manager troubleshooting documentation confirms that the command is available from a process context menu and is intended for collecting detailed process information for analysis or a support vendor. Windows Central and Digital Citizen independently document the same workflow across the consumer Windows interface. The important limitation is easy to miss: this is a user-mode dump of one application process, not a blue-screen dump of the entire PC and not a report that automatically explains the cause.
For a one-off hang, that distinction is useful. You can capture evidence before ending the app, restarting Windows, or losing the state a developer needs to inspect.
What Task Manager’s dump actually contains
A Task Manager capture records the memory and execution state of the selected application process while it is still running or hung. Microsoft describes a full user-mode dump as including the process’s memory space, its executable image, handle table, and other information a debugger can use to reconstruct what the application was doing.
That makes a dump valuable when an app has stopped drawing, is stuck at high CPU usage, consumes memory indefinitely, or has entered a repeatable bad state. A developer can open the .dmp in WinDbg and examine threads, call stacks, loaded modules, handles, and—depending on what was resident in memory—application data relevant to the malfunction.
It also makes the file sensitive. A dump can contain document fragments, account names, file paths, tokens, URLs, database connection information, chat text, or other material the affected process had in memory. Treat it as diagnostic evidence, not as an ordinary log file.
Do not confuse this command with Create live kernel memory dump file, which may appear when you right-click the System process on supported Windows 11 systems. A live kernel dump is for diagnosing Windows, drivers, or kernel-level problems and is stored separately. For an app such as Word, Chrome, a game launcher, line-of-business client, or explorer.exe, use Create memory dump file on that application’s process.
Find the process before you capture it
Open Task Manager with Ctrl + Shift + Esc. If it opens in the compact view, choose More details. The Processes page is often the quickest place to start because it groups visible apps under Apps, but the Details page is more reliable when several similarly named processes are running.
Start with the app name and expand its group in Processes if Windows shows an arrow beside it. Browsers, Electron-based desktop apps, Office components, game launchers, and security products routinely use multiple child processes. Capturing the wrong one can still produce a valid dump, but it may contain none of the thread or memory state responsible for the hang.
Move to Details when you need to distinguish among duplicates. This tab shows executable names such as chrome.exe, WINWORD.EXE, msedge.exe, or an organization’s custom client executable. Right-click a column header and enable useful columns such as:
- PID identifies the exact process instance and lets support correlate your dump with logs or Event Viewer entries.
- Command line can reveal a profile path, document path, extension, helper role, or launch argument that separates otherwise identical processes.
- User name helps distinguish the interactive app from a background service or process belonging to another signed-in user.
- CPU, Memory, and Status help identify the process that is genuinely stuck rather than an idle helper process.
The executable name matters more than the friendly label. If a support engineer asks for a dump of AcmeClient.exe, do not assume the entry labeled “Acme Client Updater” is interchangeable. Likewise, do not dump WerFault.exe merely because it appears after a crash; Windows Error Reporting is the reporting component, not necessarily the app that failed.
If the affected program has a visible window, use Task Manager’s Processes page to locate the app, then right-click it and choose Go to details when that option is available. Windows will take you to the associated executable in Details, reducing the chance of collecting the wrong child process.
Capture the dump before ending the app
Once you have selected the target process, right-click it and choose Create memory dump file. In Windows 11’s redesigned Task Manager, the wording may appear directly in the right-click menu; Windows 10 uses the same command in its traditional Task Manager menus. Microsoft says the command can be used from the process-list tabs, so either Processes or Details is acceptable.
Wait for Windows to finish writing the file. Task Manager displays a confirmation dialog with the exact path and an Open file location button. Use that button rather than assuming the dump went to a system crash-dump folder.
By default, a live user-mode dump created by Task Manager is saved in:
%LocalAppData%\Temp
For a standard local Windows profile, that normally resolves to:
C:\Users\<your-user-name>\AppData\Local\Temp
The dump normally has a .dmp extension and is often named after the process. Do not confuse it with C:\Windows\MEMORY.DMP, C:\Windows\Minidump, %LocalAppData%\CrashDumps, or Task Manager’s LiveKernelDumps folder. Those locations are associated with different Windows crash-collection mechanisms.
The filename and timestamp are useful evidence. After Task Manager reports success, copy the file to a working folder such as Documents\AppCrashEvidence before you reboot, clear temporary files, run Disk Cleanup, or continue experimenting with fixes. Temp folders are not a sensible long-term evidence store.
A process dump can be large—sometimes hundreds of megabytes or several gigabytes—because it reflects the target process’s committed memory. Make sure the system drive has sufficient free space before capturing a browser, game, virtual machine front end, design tool, or database client. A large file is not proof of a more severe defect; it may simply reflect how much memory that application was using.
Capture the state that reproduces the problem
The best time to create a dump is while the app is still exhibiting the problem. If an app freezes when opening a particular document, connecting to a VPN, exporting a report, or switching monitors, recreate that state and capture the dump before clicking End task.
For intermittent failures, record a short incident note beside the dump. Include the local date and time, the program name and version, Windows version and OS build, what action triggered the problem, whether the app was frozen or merely slow, and any exact error message. Include the process name and PID if you captured it from Details.
A practical folder might contain the following:
AcmeClient.exe.2026-09-11.dmp
incident-notes.txt
screenshot-error.pngThis accompanying context often determines whether the dump can be matched to the right logs. A .dmp without a reproduction description may show that threads were waiting, but not whether they were expected to wait for a server response, a printer driver, a network share, a plug-in, or a damaged local file.
If the application is still responding enough to use its own diagnostic collection option, follow the vendor’s requested method first. A vendor-specific bundle may include logs, configuration details, and a correctly scoped dump. Task Manager is most useful when the app has become unresponsive, the vendor has explicitly requested a process dump, or you need a fast snapshot before terminating it.
When the command is unavailable or fails
The Create memory dump file option can be unavailable when you select a grouped app entry that represents multiple subprocesses rather than one executable. Expand the group or use Go to details, then right-click the individual process. Digital Citizen notes this common behavior: the command can be disabled for an item with several subprocesses.
Permissions are the other frequent obstacle. A standard Task Manager session may not be allowed to inspect and dump an elevated process, a service, a process owned by another account, or a protected security component. Reopen Task Manager with administrative rights only if your organization’s policy allows it and only when you understand the process you are collecting. Administrative access changes what can be read from other processes; it does not make a dump safer to share.
If Task Manager itself is too unstable, the app exits before you can capture it, or the issue occurs only after a long wait, Microsoft’s Sysinternals ProcDump is the better escalation tool. ProcDump can watch for an unresponsive window or an unhandled exception and create dumps automatically, using the same general definition of a hung window that Windows and Task Manager use. That is a different workflow, however: for the immediate, one-time capture of a currently frozen application, Task Manager remains the simplest built-in option.
Send the file without exposing more than necessary
First, send the dump only to the app vendor, your internal IT or development team, or another party that specifically requested it. Do not upload it to a public forum, generic file-sharing link, issue tracker visible to other customers, or malware-scanning site unless the recipient has explicitly instructed you to do so and you have assessed the privacy implications.
Use the recipient’s official support case upload portal when one is available. If the file must be transferred another way, compress it into an archive and follow the support team’s instructions for encryption. Send any archive password through a separate approved channel, not in the same email or ticket comment as the attachment.
Keep the original .dmp unchanged. Renaming it to include the app name, date, and incident number is fine; editing or attempting to “clean” the binary file is not. If privacy review prevents sharing a full dump, tell support that directly and ask whether they can accept a smaller diagnostic package, a filtered dump, or logs instead. Microsoft’s debugging documentation notes that dump formats can be created with varying levels of memory and metadata, but Task Manager’s one-click command does not offer those privacy controls.
The immediate operational benefit is simple: capture the process while it is broken, verify the exact saved path, preserve the original file, and attach a clear incident note. That gives support something far more useful than “the app froze,” while avoiding the common mistake of rebooting or ending the process before anyone has recorded what it was doing.