Chinese state-sponsored cyber actors have been observed:  Injecting into the rundll32.exe process to hide usage of Mimikatz, as well as injecting into a running legitimate explorer.exe process for lateral movement.  Using shellcode that injects implants into newly created instances of the Service Host process (svchost).