| Previous | Next |
| STATUS_KERNEL_EXECUTABLE_MEMORY_WRITE | STATUS_TRIGGERED_EXECUTABLE_MEMORY_WRITE |
STATUS_ATTACHED_EXECUTABLE_MEMORY_WRITE
An attached kernel context modified executable process memory
Kernel components can temporarily attach to another process address space to access its virtual memory. This status records an executable-memory write made while operating in that attached context. The distinction helps identify drivers that patch or instrument a process without using a normal cross-process user-mode API.
Attachment changes address-space context, not ownership or trust. The driver must still validate the target range, synchronize against image and process teardown, and obey the security model expected by the monitored process.
What to inspect
- Record the attaching thread, kernel stack, driver image, target process, attach duration, and target VAD or section.
- Verify that the address remained valid and belonged to the intended process throughout the operation.
- Check for race conditions with module unload, process exit, protection changes, or copy-on-write faults.
- Replace undocumented code patching with supported instrumentation or inter-process interfaces where possible.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Exploit protection reference
- Microsoft: PROCESS_MITIGATION_DYNAMIC_CODE_POLICY
- Microsoft Windows SDK metadata: ntstatus.h
Looking for a different code? Search another status or error code.