The Two Functions at the Heart of It

• LoadLibraryW(path) — exported by kernel32.dll. Maps a DLL from disk into the calling process and runs its DllMain. Returns a module handle.
• GetProcAddress(hModule, name) — returns the address of an exported function inside a loaded module.

Key insight for the classic attack:

• kernel32.dll is loaded at the same base address in every process in a session (ASLR randomizes per boot, not per process).
• So the address of LoadLibraryW in the injector is also valid in the target.
• That lets the injector tell the target: "run LoadLibraryW on this path" — and the target loads the DLL itself.