#include <Windows.h>
#include <stdio.h>

BOOL InjectDll(HANDLE hProcess, LPCSTR lpFileName, SIZE_T tSize);

int main(int argc, char *argv[])
{
    LPCSTR lpFileName = "C:\\TestDll.dll";

    PROCESS_INFORMATION ProcessInformation;
    STARTUPINFO StartupInfo;
    DWORD cb;

    cb = sizeof(STARTUPINFO);
    ZeroMemory(&StartupInfo, cb);
    StartupInfo.cb = cb;

    CreateProcess("TestApp.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &StartupInfo, &ProcessInformation);

    printf("Press [Return] to continue...");
    getchar();

    InjectDll(ProcessInformation.hProcess, lpFileName, strlen(lpFileName)+1);

    ResumeThread(ProcessInformation.hThread);

    CloseHandle(ProcessInformation.hProcess);
    CloseHandle(ProcessInformation.hThread);

    return 0;
}

BOOL InjectDll(HANDLE hProcess, LPCSTR lpFileName, SIZE_T tSize)
{
    PVOID pAddress;
    HANDLE hThread;
//  DWORD ExitCode;

    pAddress = VirtualAllocEx(hProcess, NULL, tSize, MEM_COMMIT, PAGE_READWRITE);

    WriteProcessMemory(hProcess, pAddress, lpFileName, tSize, NULL);

    hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, pAddress, 0, NULL);

    WaitForSingleObject(hThread, 10000); // 10 seconds

//  GetExitCodeThread(hThread, &ExitCode);

    VirtualFreeEx(hProcess, pAddress, tSize, MEM_DECOMMIT);

    CloseHandle(hThread);

    return TRUE;
}