A funny little obfuscation technique

This report analyzes a two-stage Windows dropper that avoids common unpacker hooks by writing only a tiny stub into a target process and then reading the larger payload from the parent process (using ReadProcessMemory). The sample dynamically resolves APIs (Zeus-style encoding), decrypts an RC4-packed payload, injects via a runPE into svchost.exe, and includes several file hashes for investigation.