Class 06 · KP 05 / 21

The Classic Technique: Overview

CreateRemoteThread + LoadLibraryW runs your DLL inside another process.

Goal: get target.exe to call

LoadLibraryW("C:...evil.dll").

OpenProcess — obtain a handle to the target.
VirtualAllocEx — allocate memory inside the target.
WriteProcessMemory — write the DLL path string there.
GetProcAddress — find LoadLibraryW in kernel32.
CreateRemoteThread — start a thread in the target at LoadLibraryW, passing the path address as its argument.
Target loads the DLL; DllMain runs the payload.

Key Takeaway

Three memory operations plus one remote thread. This exact API sequence is what most detections watch for.