Windows doesn't strip sections with IMAGE_SCN_MEM_DISCARDABLE from the image in the user mode: https://github.com/fancycode/MemoryModule/blob/5f83e41c3a3e7c6e8284a5c1afa5a38790809461/MemoryModule.c#L273 So these sections have wrong access for EXE/DLL files.