Can we hook some func in another process then change return address?

Injecting a DLL into another process can be done quite easily with the regular Windows API only:
-first allocate memory in the target process with CreateRemoteThread,
-then copy some loader code and the arguments using WriteProcessMemory,
-then use CreateRemoteThread to start the loader code, which in turn calls LoadLibrary

This technique is very generic, and allows to execute any code into any process... This is useful for hooking as well, as it allows to hook only a specific process instead of the whole system....