Class 06 · KP 21 / 21

Summary

DLL injection runs your code inside another process's address space — the base primitive for hooking, evasion, and theft.
The classic chain is OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> GetProcAddress(LoadLibraryW) -> CreateRemoteThread.
Many variants trade stealth for complexity: hooks, APC, reflective loading, hollowing, thread hijacking, module stomping.
Defense stacks API telemetry, memory integrity, module provenance, and ETW/kernel callbacks.
Lab 3: build it end-to-end against Notepad.

Key Takeaway

Understand the API sequence deeply — both to build it in Lab 3 and to recognize it when analyzing real malware.