File verdict·Evidence-based security assessment

Our call: Is DualMonitorTools-2.12.msi safe?Safe

Item: DualMonitorTools-2.12.msi
Rating: 4.5
Author: MalwareTips File Scanner

Install with normal care

85Safety ratingLow observed risk

None of the 74 antivirus engines that checked this file reported a threat.

Safety rating85/100Low observed risk

Evidence snapshot

0 of 74 antivirus engines flagged the file.Observed · Antivirus analysis
The hash has a long, established submission history across 1,606 sources.Derived · Submission history
One or more independent reference checks were incomplete or unavailable.Derived · External-intelligence coverage

DualMonitorTools-2.12.msi

704.0 KB

382db114fcb9a7e64f…fc80d127df

Antivirus

0 of 74 flagged

Sandbox

Runtime complete

Code signing

Unsigned

First seen

First seen 11mo ago

01

Before installing

Install it only when it came from the developer's official site or an official app store.

02

If you already installed it

Keep normal device protection enabled and stop if the file behaves unexpectedly.

Scan transparency

Coverage & freshness

3 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
0 of 74 engines flagged the file.
Updated Jul 23, 2026, 11:23 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Jul 31, 2026, 11:17 PM UTC
Network
Partial
1 runtime contact was observed without a completed reputation cross-check.
Updated Jul 31, 2026, 11:17 PM UTC
YARA
Complete
3 signature or behavior rules matched.
Updated Jul 31, 2026, 11:17 PM UTC
External intel
Partial
Independent reference checks were attempted but are incomplete.
Updated Jul 31, 2026, 11:17 PM UTC

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

1

FileObserved
DualMonitorTools-2.12.msi
382db114fcb9a7e64f712d458ae06eeb657c3f998ec3aca0826407fc80d127df
01Uploaded file

Processes

Runtime execution

2

ProcessObserved
Observed process
"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\installer.msi" /qb ACCEPTEULA=1 LicenseAccepted=1
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\system32\services.exe
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

2

Written fileObserved
ngen.log
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
04Isolated runtime analysis
Written fileObserved
~DFFBCB5DDA658DC4CD.TMP
C:\Windows\Temp\~DFFBCB5DDA658DC4CD.TMP
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

Network

Hosts contacted

1

Contacted hostObserved
162.159.36.2
Contact observed during runtime.
06Isolated runtime analysis

6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Technical assessment

What the available evidence shows

The report separates observed facts from checks that are still incomplete.

74%Confidence

High

Analyst conclusion

None of the 74 antivirus engines that checked this file reported a threat. No malicious or suspicious antivirus result was recorded, so the available evidence supports a clean assessment.

Where this verdict could be wrong1 caveat

A clean antivirus result cannot guarantee that a newly created or highly targeted file is harmless.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

The file appears safe based on current antivirus coverage. Keep normal precautions and verify that it came from the publisher's official source.

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

6

Adversary techniques mapped to the MITRE ATT&CK framework.

T1055· Process injectionT1082· System reconT1083· Scans your filesT1091· USB spreadingT1120T1543.003· Service install

Spawned processes

11

$(unnamed)

"C:\Windows\system32\msiexec.exe" /I "C:\Users\<USER>\Desktop\installer.msi" /qb ACCEPTEULA=1 LicenseAccepted=1

$(unnamed)

C:\Windows\system32\services.exe

$(unnamed)

C:\Windows\system32\msiexec.exe /V

$(unnamed)

C:\Windows\System32\svchost.exe -k NetworkService -p

$(unnamed)

C:\Windows\system32\svchost.exe -k UnistackSvcGroup

$(unnamed)

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

$(unnamed)

C:\Windows\system32\lsass.exe

$(unnamed)

C:\Windows\system32\svchost.exe -k LocalService -s W32Time

+3 more processes captured.

Network activity

1

IP addresses1

162.159.36.2

Filesystem & mutexes

29

Files written15

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
C:\Windows\Temp\~DFFBCB5DDA658DC4CD.TMP
C:\Windows\Temp\~DFC25D9E7CA11D719F.TMP
C:\Windows\Temp\~DF5E29667FB524A045.TMP
C:\Windows\Temp\~DF67485AE6726124D0.TMP

+10 more

Files deleted9

C:\Config.Msi\CMPE37A.tmp
C:\Config.Msi
C:\Windows\Installer\def9.msi
C:\Config.Msi\CMPE7A0.tmp
C:\Config.Msi\def8.rbs

+4 more

Mutexes created5

Global\_MSIExecute
\Sessions\1\BaseNamedObjects\Global\_MSIExecute
\BaseNamedObjects\Local\SM0:6988:304:WilStaging_02
\BaseNamedObjects\Local\SM0:6988:120:WilError_03
\BaseNamedObjects\Local\SM0:1324:304:WilStaging_02

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

4db416376a50712686b7…fa962bNever scanned
never seen before
6168e44a633509d864cd…f5b235Never scanned
never seen before
12da65e640548ca30eba…a49f1aNever scanned
never seen before
31e2e41ee0bac2ed5364…0c3412Never scanned
never seen before
b6fa2dc6561f84458d01…623d1eNever scanned
never seen before
2deed5dbdb0e14e9fb2d…c1a731Never scanned
never seen before
895f4d61d748563c0e86…29f377Never scanned
never seen before
18dec1ec6a3bc60a875d…67c83aNever scanned
never seen before
f1bff38e1eb8339d9edf…dd10aaNever scanned
never seen before
a1829c3212020eafc788…523ebeNever scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

Evidence map

Detection sources at a glance

1 completed · 3 unavailable

Antivirus

No match

0/74 flagged

Malware samples

Unavailable

unavailable

Researcher rules

Unavailable

unavailable

Reference software

Unavailable

unavailable

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

No confirmed researcher-database hit

Available reference checks returned no match, but at least one source was unavailable. This is not a clean result.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

3 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1C2× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence
C:\Windows\System32\svchost.exe -k NetworkService -p
CredentialDumper
T1003 T1003.001
medium
Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
Evidence
C:\Windows\system32\lsass.exe
DirectIpC2
T1071
low
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence
162.159.36.2

Antivirus consensus

0 of 74 engines flagged this file

0 malicious0 suspicious74 not flagged

Tier-117 engines

0flagged

Tier-240 engines

0flagged

Low-trust17 engines

0flagged

No antivirus engine flagged this file.

View all 74 engine results

AcronisOK

AhnLab-V3OK

Alibabatyp

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-Mobiletyp

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

CynetOK

DrWebOK

Elastictyp

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlooktyp

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

Webroottyp

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,606

Hundreds of people have uploaded this — common.

Total submissions

1,682

Includes repeat uploads by the same source.

First seen

11mo ago

Aug 24, 2025

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: DualMonitorTools-2.12.msi
Format: Windows Installer
Code signing: No verified publisher
Size: 704.0 KB
Last analyzed: Jul 31, 2026, 11:17 PM UTC

SHA-256

382db114fcb9a7e64f712d458ae06eeb657c3f998ec3aca0826407fc80d127df

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

This file appears low risk based on the evidence available now.

Install it only when it came from the developer's official site or an official app store.
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
Keep your antivirus and Windows updates switched on so you stay protected.

Frequently asked

Safety FAQ

Is DualMonitorTools-2.12.msi safe?

DualMonitorTools-2.12.msi appears safe. 0 of 74 antivirus engines flagged it. Install it only when it came from the developer's official site or an official app store.

What is DualMonitorTools-2.12.msi?

DualMonitorTools-2.12.msi is a software installer, about 704 KB. Our analysis did not identify a verdict-driving threat signal. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).

How many antivirus engines detected DualMonitorTools-2.12.msi?

None — 0 of 74 antivirus engines flagged DualMonitorTools-2.12.msi. That's reassuring, though it is not proof that a file is safe, so we also weigh its behaviour, identity, and reputation.

What is the SHA-256 hash of DualMonitorTools-2.12.msi?

The SHA-256 hash of DualMonitorTools-2.12.msi is 382db114fcb9a7e64f712d458ae06eeb657c3f998ec3aca0826407fc80d127df, and its MD5 is a8485b0427d2146686798ac014aa976d. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

Is it safe to install DualMonitorTools-2.12.msi?

Based on the recorded evidence, DualMonitorTools-2.12.msi has a low observed risk. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it, verify the source and the exact hash before overriding the warning.

How up to date is this analysis of DualMonitorTools-2.12.msi?

This report reflects the scan run on July 31, 2026. Because a file's hash never changes, the identity of DualMonitorTools-2.12.msi is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Our call: Is DualMonitorTools-2.12.msi safe?Safe

Before installing

If you already installed it

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Attack story

Input file

DualMonitorTools-2.12.msi

Processes

Observed process

Observed process

Files

ngen.log

~DFFBCB5DDA658DC4CD.TMP

Network

162.159.36.2

Why these facts are shown

Intelligence

What the available evidence shows

What We Detected

Behavior

What this file did when executed

Files this sample writes at runtime

Detection & Forensics

Detection sources at a glance

Signatures and behavior heuristics

0 of 74 engines flagged this file

PE structure

How widely this file has been seen

Fingerprint and provenance

Safety & FAQ

What to do now

Safety FAQ

Our call: Is DualMonitorTools-2.12.msi safe?Safe

Recommended next actions

Before installing

If you already installed it

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Attack story

DualMonitorTools-2.12.msi

Observed process

Observed process

ngen.log

~DFFBCB5DDA658DC4CD.TMP

162.159.36.2

Why these facts are shown

What We Detected

Detection sources at a glance

PE structure

Fingerprint and provenance

What to do now

Safety FAQ