Image-backed Memory
↓
Memory associated with an image mapping

Private Memory
↓
Memory not dependent on a standard image mapping

VAD
↓
Kernel structures describing virtual address space ranges

And most importantly:

Private ≠ Malicious

Executable ≠ Malicious

RW → RX ≠ Malicious

What matters is the combination of evidence and context.

@reverseengine