It alters the .exe/.dll memory signature, which is the primary method vac uses to detect public cheats, you can do a comparison with any disassembler. Once vmprotect/enigma gets more popular, they will add signatures for it which antivirus scanners already do.
To stay UD, compile your own hack with plenty of mods or junk code.