Most AVs hook Windows API functions in ntdll.dll . When your injector calls CreateRemoteThread , it first jumps through ntdll!NtCreateThreadEx , where the AV has placed a jmp instruction to its inspection engine.