Three issues.
First, what are you trying to output? Your fwrite() line will output sizeof(BYTE)*sizeof(DWORD) characters in a binary format to the file. Depending on what a BYTE is, it may have a size greater than 1. If you are trying to output lpBmpPkg->dwCount then the call would be better off as fwrite(&(lpBmpPkg->dwCount), sizeof(DWORD), 1, outfile);.
The second issue is that, if you want to output a data structure using fwrite, it is not a good idea to output structures containing pointers. The pointers, however, they are initialised will probably not contain sense when the struct is read back in. So, doing fwrite(lpBmpPkg, sizeof(BMPPKGFILE), 1, outfile); will output the pointer, but the corresponding fread() call is not guaranteed to give back a useful data structure.
The third issue is that there's are a couple of practical rules you're probably ignoring.
1) the real cause of a crash is any code executed at
or before the line where the crash occurs.
2) declaring a pointer does not magically create something for that pointer to point at. You must ensure that any pointers are initialised sensibly so they point at something valid.
How are these concerns relevant? Your code for initialising bmppkg will set all the characters within bmppkg to zero and, in practice, that will have the effect of setting bmppkg.dwCount to zero and bmppkg.pEntries to a null pointer. If you dereference bmppkg.pEntries (and you are presumably doing that if other code is setting bmppkg.dwCount to a non-zero value) then you are dereferencing a NULL pointer. If I had to guess, you are doing something like this;
BMPPKGFILE bmppkg;
ZeroMemory(&bmppkg, sizeof(BMPPKGFILE));
// other things
bmppkg.dwCount = some_value;
for (DWORD i = 0; i < bmppkg.dwCount; ++i)
{
bmppkg.pEntries[i].dwEntrySize = something();
// more manipulation of bmppkg.pEntries[i]
} and, since bmppkg.pEntries is a NULL pointer, all accesses of bmppkg.pEntries[i] give you undefined behaviour. You haven't provided such code, but I'll bet code where you manipulate data stored in bmppkg is the root cause of your problem. If it's not that, there is probably some other innocent pointer being molested in your code