| Previous | Next |
| STATUS_INTERRUPT_STILL_CONNECTED | STATUS_FILE_LOCKED_WITH_ONLY_READERS |
STATUS_PROCESS_CLONED
Execution is continuing in the cloned process
STATUS_PROCESS_CLONED is an informational native status used around process-cloning machinery. It distinguishes the child side of a clone operation from the original caller. This is lower-level behavior than the normal Win32 CreateProcess contract and should be interpreted in the context of the native routine that returned it.
Capture the parent and child process IDs, the native clone call and the execution point immediately after the operation. The child inherits a snapshot of process state according to the cloning mechanism, so code must distinguish resources that can be reused from state that needs child-side reinitialization. Do not present the status as an ordinary process-creation failure.
What to inspect
- Record parent and cloned process IDs and the native process API used.
- Identify the branch that handles child-side return semantics.
- Audit locks, thread-specific state, and handles that require reinitialization after cloning.
References
- System Informer PHNT: process and thread Native API
- ReactOS: kernel process implementation
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.