Try to mix discussed payload delivery and remote execution techniques in various combinations e.g. section views with APC.
    In your experiments target an application which has more than 1 or 2 threads running (e.g. x64dbg). Can you easily trigger an APC call?
    Try to set APC calls on all threads in a target process. What happens?