kernel32.dll is being changed you could call
ReadProcessMemory itself calls this function).
ntdll.dll is also seems to be changed by 3rd party process you could copy
ntdll.dll to another temporary file (
ntdll_copy.dll), and use it:
[DllImport("ntdll_copy.dll", EntryPoint = "NtReadVirtualMemory")] private static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte lpBuffer, UIntPtr nSize, IntPtr lpNumberOfBytesRead);