Mostly when a Cisco router restart suddenly, it's because an an IOS bug, but after restarted and you run Sh run, you should get the reason.
For example:
Router#show version Cisco Internetwork Operating System Software IOS (tm) RSP Software (RSP-PV-M), Version 12.0(10.6)ST, EARLY DEPLOYMENT MAINTENANCE INTERIM SOFTWARE Copyright (c) 1986-2000 by cisco Systems, Inc. Compiled Fri 23-Jun-00 16:02 by richv Image text-base: 0x60010908, data-base: 0x60D96000
ROM: System Bootstrap, Version 12.0(19990806:174725), DEVELOPMENT SOFTWARE BOOTFLASH: RSP Software (RSP-BOOT-M), Version 12.0(9)S, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)
Router uptime is 20 hours, 56 minutes System returned to ROM by error - a Software forced crash, PC
0x60287EE8 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
System image file is "slot0:rsp-pv-mz.120-10.6.ST"
. . .
try to get the output of a show version, show stacks, show context, or show tech support command from your Cisco device, they will help you to determine the reason was due to Hardware, memory o IOS.
show stacks
---------- It's used to monitor the stack usage of processes and interrupt routines. The show stacks output is one of the most indispensable sources of information to collect when the router crashes.
show context
------------ It's used to display information stored in nonvolatile RAM (NVRAM) when an exception occurs.
There's a crashinfo file, it's a collection of useful information related to the current crash, stored in bootflash or flash memory. When a router crashes due to data or stack corruption, more reload information is needed to debug this type of crash than just the output from the normal show stacks command. Try running the Sh dir or Sh flash to see the crashinfo file