Suspicious Kernel32 Memory Protection

api where process.Ext.api.name : "VirtualProtect" and process.executable != null and 
  process.Ext.api.summary : "*kernel32.dll*" and process.Ext.api.behaviors : "write_fluctuation" and 
  process.Ext.api.parameters.size == 16 and 
  process.thread.Ext.call_stack_final_user_module.name != null and not process.thread.Ext.call_stack_final_user_module.name : "Kernel" and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("91bade6d0e01a3b0abe7f98f97e4eff2a04dbaa475c4a90e3ee97024f488606d", "ca4459a331c7dbb8440fa7eb3f0a2636b4685b762d94f16e2452a627faf9197b") and
  not process.thread.Ext.call_stack_final_user_module.path :
                                         ("?:\\Program Files\\*",
                                          "?:\\Program Files (x86)\\*", 
                                          "\\program files\\*", 
                                          "\\program files (x86)\\*",
                                          "?:\\windows\\microsoft.net\\framework*.dll", 
                                          "\\windows\\microsoft.net\\framework*.dll", 
                                          "?:\\programdata\\dell\\drivers\\*\\installer.exe", 
                                          "?:\\windows\\system32\\driverstore\\filerepository\\*", 
                                          "\\windows\\system32\\driverstore\\filerepository\\*", 
                                          "?:\\windows\\winsxs\\*", 
                                          "\\windows\\winsxs\\*", 
                                          "?:\\windows\\system32\\atiumd64.dll", 
                                          "\\windows\\system32\\atiumd64.dll")