James,
You probably won't be able to dump exp3.tmp.exe, because it has exited (notice there's an Exit time, 0 threads, and invalid handle table). The _EPROCESS structure still exists in the "active" list for reasons explained here:
http://mnin.blogspot.com/2011/03/mis-leading-active-in.html. Once the process exits, its address space, which contains the executable, is destroyed.
I'm also going to guess that pid 1448 is an exited (not hidden) process, but it made some connections during its lifetime. That's the gift and curse of scanning physical memory for data. Its able to help show what happened on a system in the past (i.e. IPs and ports contacted), but not everything is preserved. Kernel memory pools are used and re-used, allowing some allocations to survive longer than others. You found a connection object that was owned by pid 1448 at some point in time, but the _EPROCESS for pid 1448 is long gone. I'm pretty confident in psxview's ability to find hidden processes since it uses like 8 different methods. Even advanced rootkits these days don't try hiding in more than 2-3 ways....at that point its easier just to inject code into another process and hide that way.
MHL