Sometimes I do. Microsoft has not made CreateRemoteThread API to support malware, it has many legitimate uses.
For instance, one time a client wanted to have a functional equivalent of desktop duplication API working on Windows 7. I wrote a DLL that’s injected into dwm.exe, hooks IDXGISwapChain.Present and ResizeBuffers methods, copies video frames into another D3D texture, and uses DXGI surface sharing to feed frames in VRAM to the capturing/encoding process.
