I informed myself about RunPe Injection and programmed my own runPE. Right on my first try, I was able to hide a meterpreter payload from my antivirus program (Avira Antivirus).
The meterpreter payload is stored encrypted on the hard disk and then injected into the explorer.exe process and decrypted there.
The fact that the meterpreter payload cannot be recognized on the hard disk is due to the encryption, but in RAM the payload is not encrypted. Why can not the antivirus software detect the payload during a memory scan?
If you don't know what a runPE is click here.