How Attachment Works

Technically, a process can be attached by running a thread (uses the winapi function CreateRemoteThread) in the context of the process to be attached. The thread takes care of configuring the system function interceptors.

When attaching to a child process that is to be created, once initialized, the thread passes the control to the main thread of the child process.