Should I block it?

No, this file is 100% safe to run.

Relationships

PE file structure

Show functions

Import table

gdi32.dll

GetStockObject

imagehlp.dll

ImageDirectoryEntryToData

kernel32.dll

FreeLibrary, LocalFree, lstrlenA, WideCharToMultiByte, LocalAlloc, lstrlenW, GetProcAddress, FormatMessageW, GetLastError, LoadLibraryW, ActivateActCtx, CreateActCtxW, SearchPathW, GetFileAttributesW, ReleaseActCtx, DeactivateActCtx, SetErrorMode, ExitProcess, GetModuleHandleW, GetStartupInfoW, GetCommandLineW, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter

msvcrt.dll

DllMain

user32.dll

RegisterClassW, LoadStringW, CharNextW, SetClassLongW, LoadIconW, DefWindowProcW, CreateWindowExW, MessageBoxW, LoadCursorW, DestroyWindow

rundll32.exe

Microsoft Windows Operating System by Microsoft

Remove rundll32.exe

Version:	5.1.2600.5512 (xpsp.080413-2105)
MD5:	e0668814b1b8528defe74a3a09a1ed51
SHA1:	527a0a9f600bb9ac0f66036d77da1f30c79c0211
SHA256:	d59c4a9d37b189c35ab4882ad2882e7faf25e1e3047c35c758ef20096e73de98

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

rundll32.exe executes as a process with the local user's privileges. This version is installed on Windows XP and is compiled as a 32 bit program.

Details

File name:	rundll32.exe
Publisher:	Microsoft Corporation
Product name:	Microsoft(R) Windows(R) Operating System
Description:	Run a DLL as an App
Typical file path:	C:\Windows\System32\rundll32.exe
Original name:	RUNDLL.EXE
File version:	5.1.2600.5512 (xpsp.080413-2105)
Product version:	5.1.2600.5512
Size:	32 KB (32,768 bytes)
Build date:	4/14/2008 2:37 AM
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00235400%	0.028634%
Kernel CPU:	0.00225861%	0.013761%
User CPU:	0.00009539%	0.014873%
Kernel CPU time:	2,734 ms/min	100,923,805ms/min
Context switches:	508/sec	284/sec
Memory
Private memory:	8.9 MB	21.59 MB
Private (maximum):	740 KB
Private (minimum):	548 KB
Non-paged memory:	8.9 MB	21.59 MB
Virtual memory:	53.53 MB	140.96 MB
Virtual memory (peak):	54.31 MB	169.69 MB
Working set:	740 KB	18.61 MB
Working set (peak):	12.04 MB	37.95 MB
Page faults:	45,398/min	2,039/min
I/O
I/O read transfer:	4.36 KB/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	62 Bytes/sec	448.09 KB/min
I/O other operations:	3/sec	1,671/min
Resource allocations
Threads:	5	12
Handles:	32493	600
GUI GDI count:	21	103
GUI USER count:	7	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	"C:\Program Files\garena plus\gagmhook.dll",rundll_entry
Owner:	User

Threads