Why does msfvenom payload dll create the run32dll subprocess after it is injected into the explorer process memory?

I am researching payloads that msfvenom (metasploit framework) can be generated and existing methods of injection them into processes for manual incident investigation.
Initial data

Target: Windows 10 x64 (19041.804)
Client: Kali Linux 2… Continue reading Why does msfvenom payload dll create the run32dll subprocess after it is injected into the explorer process memory?