  Windows OS kernel memory is one of the main targets of cyber-attacks. By
launching such attacks, hackers are succeeding in process privilege escalation
and tampering with users data by accessing kernel mode memory. This paper
considers a new example of such an attack, which results in access to the files
opened in an exclusive mode. Windows built-in security features prevent such
legal access, but attackers can circumvent them by patching dynamically
allocated objects. The research shows that the Windows 10, version 1809 x64 is
vulnerable to this attack. The paper provides an example of using MemoryRanger,
a hypervisor-based solution to prevent such attack by running kernel-mode
drivers in isolated kernel memory enclaves.
