- Software and digital services
- Operating system
ATTEMPTED_WRITE_TO_READONLY_MEMORY
Windows ATTEMPTED_WRITE_TO_READONLY_MEMORY: driver at fault
Risk level
Medium
Proceed carefully and stop if the check is unclear.
Urgency
High
Quick answer
A driver tried to write to a memory area marked read-only and Windows stopped it. Check whether the blue screen shows a .sys file name: that driver is the first one to update, roll back or disable.
Safety first
Stop and check this first
- Before rolling back drivers or using a restore point, back up your personal files; some changes cannot be undone.
- Disabling a device as a test can stop something you use daily, such as networking or sound; note what you changed so you can revert it.
Safe checks you can perform
- Read the .sys name on the blue screen
- Update, roll back or disable that driver
- External peripherals connected recently
- Full anti-malware scan
Leave these tasks to a qualified professional
- Do not attempt this professional task: Driver identification from the dump
- Do not attempt this professional task: Fixed version from the vendor
What a technician must be able to justify
Technician visit
These are the steps they must carry out and show you. Tick them as they work: if steps are skipped, do not accept a part swap.
These are not instructions for opening or handling the equipment yourself. They are the checks that should support a technical conclusion.
Driver identification from the dump
What they doA technician opens MEMORY.DMP or the minidump in WinDbg with Microsoft public symbols and runs !analyze -v to read the responsible driver and the address it tried to write.
They must show youthe !analyze -v output with the MODULE_NAME and IMAGE_NAME fields.
In writingthe driver identified, its vendor and the action taken: update, roll back or disable.
Fixed version from the vendor
What they doWith the driver name, its vendor or your PC maker should provide a version that does not trigger the stop or confirm that the device is not compatible.
They must show youthe driver version they propose and the change or compatibility notes.
In writingthe case number and the recommended version or the incompatibility statement.
Before accepting a part or repair
Nothing has been shown yet. Do not accept a part swap based on the code alone.
Follow these steps
Note: Follow the documented order. An error code identifies the affected system, but it does not prove by itself which part has failed.
Read the .sys name on the blue screen
- Who:
- you, with your phone ready to take a photo.
- How:
- when the blue screen appears, photograph all of it and look below the code for a line with a file ending in .sys; if there is no time, check Event Viewer, System log, for the critical error at that time.
- Result that matters:
- having the exact name of the driver that attempted the forbidden write.
- If a .sys file appears, look it up under the device's Properties, Driver tab, to learn which device or program it belongs to.
- If none appears, keep the photos and let dump analysis identify it.
- Evidence to keep:
- readable photo with code 0xBE and the .sys file name if shown.
Evidence: Troubleshooting Windows unexpected restarts and stop code errors · Bug Check 0xBE ATTEMPTED_WRITE_TO_READONLY_MEMORY
Update, roll back or disable that driver
- Who:
- you, with your personal files copied off the PC.
- How:
- download the latest version of the named driver from the maker's website; if the crash began after updating it, use Roll Back Driver in Device Manager, and if no fixed version exists, disable the device or service.
- Result that matters:
- taking the driver named on the blue screen out of the equation.
- If after the change the stop does not return for several days, keep the working version and avoid needless updates.
- If it persists with another version or with the device disabled, the culprit may be different and dump analysis is next.
- Evidence to keep:
- driver versions tried and the date of each change.
Evidence: Stop code error or bug check troubleshooting (IT professionals) · Troubleshooting Windows unexpected restarts and stop code errors
External peripherals connected recently
- Who:
- you, shutting the PC down before unplugging.
- How:
- disconnect the last USB device, dock, external card or accessory you added before the blue screens began and use the PC for a few days without it.
- Result that matters:
- seeing whether that peripheral's driver causes the improper write.
- If without the device it does not recur, ask its maker whether it is compatible with your Windows version.
- If it recurs just the same, plug it back in, since that device is not the trigger.
- Evidence to keep:
- device disconnected and days of use without stops.
Evidence: Stop code error or bug check troubleshooting (IT professionals) · Troubleshooting Windows unexpected restarts and stop code errors
Full anti-malware scan
- Who:
- you, online with your antivirus ready.
- How:
- download Microsoft Safety Scanner from Microsoft's website or use your updated antivirus and run a full scan of the PC.
- Result that matters:
- ruling out malicious software altering system drivers.
- If it finds and removes threats, restart and watch whether the stops end.
- If it finds nothing, the faulty driver theory remains the main one.
- Evidence to keep:
- dated scan report and any threats found.
Evidence: Stop code error or bug check troubleshooting (IT professionals)
Still not solved
If the error persists, stop here. See what the technician must do and show you.
Where this code applies
A code is meaningful only inside the right product and version context.
Primary scope
- System
- Software and digital services
- Brand
- Microsoft Windows
- Product type
- Operating system
Known code variants
- 0x000000BE
- 0xBE
- ATTEMPTED WRITE TO READONLY MEMORY
- STOP 0x000000BE
- stop code ATTEMPTED_WRITE_TO_READONLY_MEMORY
What it means
Microsoft issues bug check 0x000000BE when a driver tries to write to a read-only memory segment. If the system manages to identify the offender, it prints its name on the blue screen and keeps it in memory for later analysis. Parameter 1 is the virtual address of the attempted write and parameter 2 the page table entry (PTE) contents. The stop describes a driver's behaviour, not a breakdown: by itself it does not prove that memory, the disk or any other part is defective.
Warnings and stop conditions
- Mediumsource verified
Before rolling back drivers or using a restore point, back up your personal files; some changes cannot be undone.
Evidence: Troubleshooting Windows unexpected restarts and stop code errors
- Lowsource verified
Disabling a device as a test can stop something you use daily, such as networking or sound; note what you changed so you can revert it.
Evidence: Stop code error or bug check troubleshooting (IT professionals) · Troubleshooting Windows unexpected restarts and stop code errors
Symptoms and causes
Probable causes · in order
- A driver with a programming faultCommon
Microsoft's page frames it as a driver writing to write-protected memory; when it can be identified, its name appears on screen.
Evidence: Bug Check 0xBE ATTEMPTED_WRITE_TO_READONLY_MEMORY
- Newly installed or updated driver or programCommon
The guide for professionals says to contact the vendor if the error names a driver or after software or hardware changes, and to disable it if no update exists.
Evidence: Stop code error or bug check troubleshooting (IT professionals)
- Malware tampering with driversLess common
Among the general steps, Microsoft includes running Microsoft Safety Scanner or another antivirus that also checks the master boot record.
Evidence: Stop code error or bug check troubleshooting (IT professionals)
Virtual technician
Does ATTEMPTED_WRITE_TO_READONLY_MEMORY still appear after these checks?
Answer a few questions to narrow down the likely cause and the safest next action. Guidance only - it never replaces a professional.
Sources and technical references
- 1
Stop code error or bug check troubleshooting (IT professionals)
Microsoft · 2026 · official_doc
- 2
Troubleshooting Windows unexpected restarts and stop code errors
Microsoft · 2026 · official_doc
- 3
Solución de problemas de reinicios inesperados y errores de código de detención de Windows
Microsoft · 2026 · official_doc
- 4
Bug Check 0xBE ATTEMPTED_WRITE_TO_READONLY_MEMORY
Microsoft · 2026 · official_doc
Was this entry useful?