detection.wiki

Error Instrument

EventTitleChannelSampleRule
1072Error Instrument: ProcessName: ProcessName WindowTitle: WindowTitle …ApplicationNN
1073742896Error Instrument: ProcessName: Error_Instrument_ProcessName WindowTitle: …ApplicationNN

Event ID 1072: Error Instrument: ProcessName: ProcessName WindowTitle: WindowTitle MsgCaption: MsgCaption MsgText: MsgText CallerModuleName: CallerModuleName BaseAddr: BaseAddress ImageSize: ImageSize Ret...

#
Channel
Application

Fields #

NameDescription
ProcessName UnicodeString
WindowTitle UnicodeString
MsgCaption UnicodeString
MsgText UnicodeString
CallerModuleName UnicodeString
BaseAddress Pointer
ImageSize UInt32
ReturnAddress Pointer
__binLength UInt32
binary Binary

Event ID 1073742896: Error Instrument: ProcessName: Error_Instrument_ProcessName WindowTitle: WindowTitle MsgCaption: MsgCaption MsgText: MsgText CallerModuleName: CallerModuleName BaseAddr: BaseAddr ImageSize: ImageSi...

#
Channel
Application

Description

Error Instrument: ProcessName: Error_Instrument_ProcessName WindowTitle: WindowTitle MsgCaption: MsgCaption MsgText: MsgText CallerModuleName: CallerModuleName BaseAddr: BaseAddr ImageSize: ImageSize ReturnAddr: ReturnAddr.

Message #

Error Instrument: ProcessName: %1  WindowTitle: %2  MsgCaption: %3  MsgText: %4  CallerModuleName: %5  BaseAddr: %6  ImageSize: %7   ReturnAddr: %8

Fields #

NameDescription
Error_Instrument_ProcessNameError Instrument: ProcessName.
WindowTitle UnicodeString
MsgCaption UnicodeString
MsgText UnicodeString
CallerModuleName UnicodeString
BaseAddr
ImageSize UInt32
ReturnAddr
ProcessName UnicodeString
BaseAddress Pointer
ReturnAddress Pointer
binary Binary

Provenance

ETW provider GUID cd7cf0d0-02cc-4872-9b65-0dba0a90efe8

Defined in user32.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02