Event ID 1000 Application Error cmd.exe kernelbase.dll

You'd probably want to first find out who is actually executing cmd.exe, which is not included in the event. I would first look into your security event log to see if you have 4688 and 4689 events there. You can then look for the 4688 event that occurred around the same time the Application Error happened (although it's possible that cmd.exe ran for a while before it crashed).

If going through the security event log is too tedious, then you can also install a free trial version of EventSentry which normalizes process activity security events and makes them easier to search through.

The 4688 event may also include the command line arguments if the group policy is configured that way (see the system32 link above) that should help track down what's causing it.