I don't get what's new about Early Bird code injection. 
A year ago I made this info graphic about common process injection techniques and it has the steps in there.https://twitter.com/struppigel/status/885388915426906113 …
Indeed, it's just NtQueueUserApc as you have covered in your infograph. Also covered in @LordNoteworthy's Al-Khaser since 2016:
https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Code%20Injections/QueueUserAPC.cpp …
-
-
doesn't cuckoo uses that to inject its monitor dll for hooking ?https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c#L522 …
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.