diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index d9861d9c8..4727d5ff0 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -61,7 +61,7 @@ class Malfind(interfaces.plugins.PluginInterface):
             vad: the MMVAD structure to test
 
         Returns:
-            A boolean indicating whether a vad is empty or not
+            A boolean indicating whether a VAD is empty or not
         """
 
         CHUNK_SIZE = 0x1000
@@ -112,13 +112,13 @@ class Malfind(interfaces.plugins.PluginInterface):
         code.
 
         Args:
-            context: The context to retrieve required elements (layers, symbol tables) from
+            context: The context to retrieve required elements (layers, symbol tables)
             kernel_layer_name: The name of the kernel layer from which to read the VAD protections
             symbol_table: The name of the table containing the kernel symbols
             proc: an _EPROCESS instance
 
         Returns:
-            An iterable of VAD instances and the first 64 bytes of data containing in that region
+            An iterable of VAD instances and the first 64 bytes of data contained in that region
         """
         proc_id = "Unknown"
         try:
@@ -144,7 +144,7 @@ class Malfind(interfaces.plugins.PluginInterface):
             if not write_exec:
                 """
                 # Inspect "PAGE_EXECUTE_READ" VAD pages to detect
-                # non writable memory regions having been injected
+                # non-writable memory regions having been injected
                 # using elevated WriteProcessMemory().
                 """
                 if "EXECUTE" in protection_string:
@@ -152,7 +152,7 @@ class Malfind(interfaces.plugins.PluginInterface):
                         vad.get_start(), vad.get_end(), proc_layer.page_size
                     ):
                         try:
-                            # If we have a dirty page in a non writable "EXECUTE" region, it is suspicious.
+                            # If we have a dirty page in a non-writable "EXECUTE" region, it is suspicious.
                             if proc_layer.is_dirty(page):
                                 dirty_page = page
                                 break
@@ -188,10 +188,10 @@ class Malfind(interfaces.plugins.PluginInterface):
                 yield (vad, data)
 
     def _generator(self, procs):
-        # determine if we're on a 32 or 64 bit kernel
+        # Determine if we're on a 32 or 64 bit kernel
         kernel = self.context.modules[self.config["kernel"]]
 
-        # set refined criteria to know when to add to "Notes" column
+        # Set refined criteria to know when to add to "Notes" column
         refined_criteria = {
             b"MZ": "MZ header",
             b"\x55\x8b": "PE header",
@@ -204,7 +204,7 @@ class Malfind(interfaces.plugins.PluginInterface):
         )
 
         for proc in procs:
-            # by default, "Notes" column will be set to N/A
+            # By default, "Notes" column will be set to N/A
             process_name = utility.array_to_string(proc.ImageFileName)
 
             for vad, data_object in self.list_injection_sites(
@@ -215,10 +215,10 @@ class Malfind(interfaces.plugins.PluginInterface):
                 data = data_object.context.layers[data_object.layer_name].read(
                     data_object.offset, data_object.length, True
                 )
-                if data[0:2] in refined_criteria:
-                    notes = refined_criteria[data[0:2]]
+                if data[:2] in refined_criteria:
+                    notes = refined_criteria[data[:2]]
 
-                # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
+                # If we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64
                 if is_32bit_arch or proc.get_is_wow64():
                     architecture = "intel"
                 else: