SY0-501 · Question #370
A technician suspects that a system has been compromised. The technician reviews the following log entry: WARNING - hash mismatch: C:\Window\SysWOW64\user32.dll WARNING - hash mismatch…
The correct answer is A. Rootkit. The log entries showing hash mismatches for critical system DLLs like user32.dll and kernel32.dll strongly suggest a rootkit, as these malware types often modify core operating system components to maintain stealth and persistence.
Question
A technician suspects that a system has been compromised. The technician reviews the following log entry:
WARNING - hash mismatch: C:\Window\SysWOW64\user32.dll WARNING - hash mismatch: C:\Window\SysWOW64\kernel32.dll Based solely on the above information, which of the following types of malware is MOST likely installed on the system?
Options
- ARootkit
- BRansomware
- CTrojan
- DBackdoor
How the community answered
(31 responses)- A74% (23)
- B16% (5)
- C6% (2)
- D3% (1)
Why each option
The log entries showing hash mismatches for critical system DLLs like `user32.dll` and `kernel32.dll` strongly suggest a rootkit, as these malware types often modify core operating system components to maintain stealth and persistence.
Rootkits operate at a low level within the operating system, often by modifying or replacing core system files (such as `user32.dll` and `kernel32.dll`) or kernel modules to hide their presence and activities. A hash mismatch on these essential files indicates they have been tampered with, which is a classic tactic for a rootkit to subvert system integrity checks and achieve stealth and persistence.
Ransomware primarily focuses on encrypting user data and demanding a ransom, not typically on modifying core system DLLs in a way that generates hash mismatch warnings to hide its presence.
A Trojan disguises malicious software as legitimate, but the specific behavior of modifying core operating system DLLs to subvert system integrity and hide is more characteristic of a rootkit than a general Trojan.
A backdoor provides covert access to a system, but the log entry specifically points to modification of core system files to hide, which is a characteristic method of a rootkit to maintain its presence, rather than just the function of a backdoor itself.
Concept tested: Rootkit behavior and detection via file integrity monitoring
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/rootkits-prevent-and-remove/
Topics
Community Discussion
No community discussion yet for this question.