monprocesscontrol.sys

MonProcessControl.sys is a kernel driver from HONOR Device Co., Ltd., the smartphone-and-PC maker that spun off from Huawei in 2020. The driver supports MagicAnimation and the MagicSpaceTurbo utility bundled with HONOR laptops; its device object is accessible to the HONOR user-mode process.

It is on the public LOLDrivers list as of October 2026 following the "KillerLand" proof of concept by researcher Jehad Abudagga, which exercises a process-termination IOCTL (0x22400C) that opens the caller-supplied PID with a kernel handle and calls ZwTerminateProcess. The driver does check that the opening process's image path ends with the HONOR MagicSpaceTurbo executable path, but the published proof of concept copies itself into that path before issuing the IOCTL, which satisfies the check. The LOLDrivers reviewers reproduced the static behaviour; protected-process termination was reported by the researcher but not independently reproduced in that review. No CVE has been assigned at the time of catalog entry.

If you own a HONOR laptop and MagicAnimation is installed, this driver is expected. Install HONOR's current PC Manager / MagicSpaceTurbo updates when they ship a fixed build; Microsoft's Vulnerable Driver Blocklist covers known-bad builds when the feature is enabled. If no HONOR hardware is on the machine, identify what placed the driver and remove it.

monprocesscontrol.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.