A SOC analyst reviewing EDR telemetry on a Windows workstation notices that a legitimate process, svchost.exe, was launched by explorer.exe rather than services.exe. Shortly after launch, the process's memory was written to by another process, its original image section was unmapped, and new executable code was mapped into that region before a thread resumed execution. Which technique is MOST likely being observed?