Malware / ransomware / security products have been doing this for many years, especially to Windows modules like kernel32.dll and ntdll.dll.
I've used nearly the same code for years with a trampoline function (JMP instruction instead of simply writing the code right there), so not too sure about it being a new technique.
In my opinion, CreateRemoteThread is the function that usually triggers AVs and injecting code into processes is the suspicious part.
This is a common firmware modification trick, but interesting to see in a dynamic way.