As I Commented the Address You are pointing to is not the start of process
it is the address of EPROCESS block for the process
kd> ? @$proc
Evaluate expression: -2063161104 = 8506a8f0
kd> !process 0 0 calc.exe
PROCESS 8506a8f0 SessionId: 1 Cid: 0ba4 Peb: 7ffdf000 ParentCid: 079c
DirBase: 7e5b96a0 ObjectTable: bf8038b8 HandleCount: 75.
kd> .shell -ci "?? @$proc" head -n4
struct _EPROCESS * 0x8506a8f0
+0x000 Pcb : _KPROCESS
+0x098 ProcessLock : _EX_PUSH_LOCK
+0x0a0 CreateTime : _LARGE_INTEGER 0x01d81de1`f57a8fda
.shell: Process exited
the process module is mapped into the virtual address space of the process these spaces are available in the VAD or Virtual Address Descriptor
the memory of such space may or may not be available in the dump
most modules have init sections that are discarded once the loader has done its job
those memory spaces may not be available in the dump
in an x86 (32 bit process ) the user mode va normally ranged from 0 to 0x7fffffff (2gb)
in x64 it is 2 TB see link
from your query I think you want to dump a module and not process
process is a collection of threads
module is a file that is mapped in a certain area in the virtual address space of the process with appropriate read , write or execute permissions.
the running threads then read & write data or execute code as the case may be from those mapped spaces
if you need to know where a module (file calc.exe ) is loaded in the virtual address space of process (process calc.exe) you can use lm (loaded module command) or !vad (address as expression ) commands then use dd . dq db to view and .writemem to write to a file
the demo below is from a live system you may encounter page does not exist if you try to write not existent pages from dump
0: kd> ? @$proc
Evaluate expression: -53307480042816 = ffffcf84`629692c0
0: kd> ? calculator
Evaluate expression: 140698911440896 = 00007ff7`04a30000
0: kd> lm m calculator
start end module name
00007ff7`04a30000 00007ff7`04e1f000 Calculator (deferred)
0: kd> db 00007ff7`04a30000 l20
00007ff7`04a30000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ..............
00007ff7`04a30010 b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 ........@.......
0: kd> !dh 00007ff7`04a30000
File Type: EXECUTABLE IMAGE
SECTION HEADER #1
211CDB virtual size
1000 virtual address
211E00 size of raw data and so on output truncated for brevitey
0: kd> .writemem c:\foo.bin 00007ff7`04a30000 l40
Writing 40 bytes.
0: kd> .shell -ci "$$" xxd c:\foo.bin
<.shell waiting 10 second(s) for process>
00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
00000010: b800 0000 0000 0000 4000 0000 0000 0000 ........@.......
00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000030: 0000 0000 0000 0000 0000 0000 f800 0000 ................
.shell: Process exited