File details
File name: rundll32.exe
Name: Windows host process (Rundll32)
Description: Microsoft® Windows® Operating System
Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product version: 6.1.7600.16385
Size: 43.5 KB
Original file name: RUNDLL32.EXE.MUI
Windows file protection:
Yes
Resource utilization
 | CPU utilization averages |
Total CPU: 0.0366990233%
Privileged CPU:
0.0132479028%

User CPU:
0.02345112052424%

Privileged CPU time: 832161.33 ms
Privileged CPU time /min: 799 ms
CPU cycle count:
500,206,761
CPU cycle count /min: 110,544,452
Context switches /sec:
27
 | Memory utilization averages |
Committed memory:
86.65 MB
Peak committed memory: 88.6 MB
Paged memory:
7.64 MB
Peak paged memory: 7.81 MB
Paged system memory:
146.13 KB
Non-paged system memory: 12 KB
Working set memory:
7.76 MB
Peak working set memory: 10.51 MB
Min working set memory: 6.86 MB
Private memory:
7.64 MB
Page faults:
4,103
Page faults /min: 235
 | Process I/O averages |
Total read operations:
271
Read operations /min: 5
Total read transfer: 82.99 KB
Read transfer /min: 7.67 KB
Total write operations:
310
Write operations /min: 50
Total write transfer: 3.12 MB
Write transfer /min: 513.87 KB
Total other operations:
2,610
Other operations /min: 106
Total other transfer: 20.65 KB
Other Transfer /min: 1.92 KB
 | GUI Object Averages |
GDI objects:
19
Peak GDI objects: 22
USER objects:
10
Peak USER objects: 15
Resources
Handle count average: 144
Thread count average: 5
Thread resource averages
Total CPU: 0.035146297280%
Privileged CPU: 0.011907374382%
User CPU: 0.023238922897%
CPU Cycle count /sec: 993,786
Context switches /sec: 2
Module memory size: 56 KB
ntdll.dll

Total CPU: 0.000082179514%
Privileged CPU: 0.000000000000%
User CPU: 0.000082179514%
CPU Cycle count /sec: 209
Module memory size: 1.23 MB
Process details
Runs as (owner): User
Integrety level: High
Windows platform: 32-bit
Hosted Process
Parent Processes
Process Commands
"C:\Windows\System32\rundll32.exe" CMICNFG3.cpl,CMICtrlWnd
"C:\Windows\System32\rundll32.exe" P17RunE.dll,RunDLLEntry
"C:\Windows\System32\rundll32.exe" toolkit.dll,widgetHost 13625637532356
"rundll32.exe" "C:\Program Files\McAfee\SiteAdvisor\saHook.dll" saHooker_Initialize_and_Wait
"C:\Windows\System32\rundll32.exe" SPIRunE.dll,RunDLLEntry
Autoplay handler details
Name: WinampMTPHandler
Command: SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\AutoplayHandlers\Handlers\WinampMTPHandler
Approved shell extension details
CLSID: {9D687A4C-1404-41ef-A089-883B6FBECDE6}
Scheduled task details
Name: PC Utility Kit Registration3
Command: \PC Utility Kit Registration3
Startup files (user) run details
Name: uprkr
Command: rundll32.exe ",RetrieveKey
User start menu folder details
Name: rundll32.exe
Startup files (all users) run details
Name: CTMasterOnOffMonitor
Command: Rundll32.exe CTMWatch.dll StartCTMasterOnOffWatch
Network connectivity
UDP: LISTENING on port 51461
Image hashes
MD5: 51138beea3e2c21ec44d0932c71762a8
SHA-1: 8939cf35447b22dd2c6e6f443446acc1bf986d58
SHA-256: 5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
PE image details
Subsystem: Windows GUI
Langauge*: Microsoft Visual C++
File entropy: 6.05669
File packed: No
Import Table
api-ms-win-core-path-l1-1-0.dll

imagehlp.dll

ImageDirectoryEntryToData
kernel32.dll

ExitProcess
GetCommandLineW
EncodePointer
GetNativeSystemInfo
SetFilePointer
SetErrorMode
FreeLibrary
CreateProcessW
LoadLibraryExW
GetCurrentProcess
SetProcessDEPPolicy
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryW
WideCharToMultiByte
FormatMessageW
ReadFile
CreateFileW
ReleaseSRWLockShared
Wow64EnableWow64FsRedirection
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
CreateEventW
DecodePointer
HeapSetInformation
AcquireSRWLockShared
GetCurrentThreadId
CloseHandle
LocalFree
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
TerminateProcess
QueryActCtxW
SearchPathW
SetSearchPathMode
GetModuleHandleW
CreateActCtxW
ActivateActCtx
ResolveDelayLoadedAPI
DelayLoadFailureHook
ReleaseActCtx
GetFileAttributesW
DeactivateActCtx
CompareStringW
lstrlenA
lstrlenW
LoadLibraryW
LoadLibraryA
LoadLibraryExA
msvcrt.dll
ntdll.dll

NtOpenProcessToken
NtQueryInformationToken
NtSetInformationToken
NtClose
RtlNtStatusToDosError
RtlImageNtHeader
NtSetInformationProcess
shlwapi.dll

PathIsRelativeW
SHSetThreadRef
user32.dll

CreateWindowExW
SetWindowLongW
GetClassNameW
SetClassLongW
RegisterClassW
LoadIconW
GetClassLongW
DestroyWindow
GetMessageW
DefWindowProcW
GetWindow
CharNextW
GetWindowLongW
LoadCursorW
TranslateMessage
LoadStringW
PostThreadMessageW
MessageBoxW
DispatchMessageW