VirtualProtectEx
Protection: PAGE_EXECUTE_READWRITE 0x40
in malware that almost always means "injected code"