| Previous | Next |
| STATUS_EXECUTABLE_MEMORY_WRITE | STATUS_ATTACHED_EXECUTABLE_MEMORY_WRITE |
STATUS_KERNEL_EXECUTABLE_MEMORY_WRITE
A kernel-originated write targeted executable process memory
This status distinguishes a write initiated from kernel mode from an ordinary user-mode store. Legitimate sources can include driver instrumentation, compatibility software, or security products, but modifying executable user pages from the kernel bypasses normal process-level write paths and deserves precise attribution.
The process policy and target protection still matter. A signed driver is not automatically authorized to patch arbitrary code, and disabling the process mitigation only removes detection rather than proving the write safe.
What to inspect
- Capture the kernel stack, responsible driver module, target process, virtual address, and region protection.
- Check whether the target is an image section, JIT code cache, private executable allocation, or shared section.
- Compare driver version and documented behavior with Code Integrity, EDR, or verifier events at the same time.
- Update or remove the responsible component instead of granting broad executable-write permission.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Exploit protection reference
- Microsoft: PROCESS_MITIGATION_DYNAMIC_CODE_POLICY
- Microsoft: VirtualProtect
Looking for a different code? Search another status or error code.