Bug Check 0x5: INVALID_PROCESS_ATTACH_ATTEMPT

The INVALID_PROCESS_ATTACH_ATTEMPT bug check has a value of 0x00000005. This generally indicates that the thread was attached to a process in a situation where that is not allowed. For example, this bug check could occur if KeAttachProcess was called when the thread was already attached to a process (which is illegal), or if the thread returned from certain function calls in an attached state (which is invalid),

This bug check appears very infrequently.

Important

This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

INVALID_PROCESS_ATTACH_ATTEMPT Parameters

Parameter	Description
1	The pointer to the dispatcher object for the target process, or if the thread is already attached, the pointer to the object for the original process.
2	The pointer to the dispatcher object of the process that the current thread is currently attached to.
3	The value of the thread's APC state index.
4	A non-zero value indicates that a DPC is running on the current processor.

Remarks

The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.

This bug check can occur if the driver calls the KeAttachProcess function and the thread is already attached to another process. It is better to use the KeStackAttachProcess function. If the current thread was already attached to another process, the KeStackAttachProcess function saves the current APC state before it attaches the current thread to the new process. Calling KeStackAttachProcess incorrectly can also cause this bug check, for example if a DPC is running on the current processor.

For general information about this area, see working with Windows Kernel-Mode Process and Thread Manager and Introduction to Kernel Dispatcher Objects.