diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py
index b0c162f46..183e4095c 100644
--- a/volatility3/framework/plugins/windows/direct_system_calls.py
+++ b/volatility3/framework/plugins/windows/direct_system_calls.py
@@ -433,6 +433,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
             proc_layer = self.context.layers[proc_layer_name]
 
             vads = self.get_vad_maps(proc)
+            if not vads:
+                continue
 
             # for each valid process, look for malicious syscall invocations
             for address, vad_path in self._get_rule_hits(