I have probably mentioned this before, but I think it is worth mentioning again because of the frequency of this issue.
When debugging a crash, we usually get customers to use a crash rule in debug diag or to use adplus -crash to get memory dumps at the point of the crash. Both of these attach to the process and gathers dumps when the process is shutting down, which is exactly what we want...
The problem is that very often we will get what I call "false-positive" dumps. I.e. dumps when the process is shutting down, but not dumps of an actual crash, or at least not the shutdown we are trying to troubleshoot.
A typical characteristic of such a memory dump is that thread 0 is in the middle of a "normal shutdown"
0:000> kL ChildEBP RetAddr 0006fc4c 79f96d9b kernel32!ExitProcess 0006fe74 79f96dc7 mscorwks!SafeExitProcess+0x11a 0006fe80 79f0c4a4 mscorwks!HandleExitProces ...
Go to the complete details ...