WCU / Cybersecurity
~/CSC 471/Class 06/KP 01
Class 06 · KP 01 / 21

What Is DLL Injection?

classic DLL injectionOpenProcessVirtualAllocExWriteProcessMemoryCreateRemoteThread→ LoadLibraryWtarget loads DLL
CreateRemoteThread + LoadLibraryW runs your DLL inside another process.
  • DLL injection: forcing a target process to load and run code (a DLL) inside its own address space.
  • Your code then runs as the target: same privileges, same modules, same handles, same network identity.
  • Once inside, injected code can:
  • Hook API calls (intercept / modify behavior).
  • Read and steal in-memory data (credentials, keys, decrypted buffers).
  • Hide activity behind a trusted process name.
  • A neutral primitive: used by malware, but also by anti-cheat, debuggers, EDR, and legitimate instrumentation tools.
Key Takeaway

DLL injection = "run my code in someone else's process." It is the foundation for API hooking, evasion, and data theft.