$sqlstmt = 'EXECUTE TestProcedure ('.join(",", values %hash).')';
Or to quote the values:
$sqlstmt = 'EXECUTE TestProcedure ('.join(",", map {"'".$_."'"} values %hash).')';