loadlibaddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); stringaddr = (LPVOID)VirtualAllocEx(process, NULL, strlen(dllname), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(process, (LPVOID)stringaddr, dllname, strlen(dllname), NULL); HANDLE thread=CreateRemoteThread(process, NULL, NULL, (LPTHREAD_START_ROUTINE)loadlibaddr, (LPVOID)stringaddr, NULL, NULL);//load the function into targets memory if(thread==NULL){ return false; } WaitForSingleObject(thread,INFINITE); DWORD exitcode; GetExitCodeThread(thread,&exitcode); /* HMODULE findoff=LoadLibrary(dllname);//find the offset of the function (offset from start of loaded module) DWORD modfunc=(DWORD)GetProcAddress(findoff,(LPSTR)1);//1 meaning the first exported function in the dll exitcode+=modfunc-(DWORD)findoff; HANDLE thread2=CreateRemoteThread(process,NULL,NULL,(LPTHREAD_START_ROUTINE)exitcode,NULL,NULL,NULL);//execute the function if(thread2==NULL){ return false; } */ When i enable commented code, it works.. why? it should work earliler where i load DLL