win11 audit failure on "scriptControl64_17605.dll"

Question

win11 audit failure on "scriptControl64_17605.dll"

Wong, Herman ., Sheriff 10

I am seeing this event viewer security log error on multiple Windows 11 machines.

code integrity determined that the image hash of a file is not valid. the file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

file name: ...ScriptControl64_17605.dll

Anyone know if this is a known problem? User's image

CtrlAltSec Cyber_Stoic 0 Reputation points

2025-06-27T11:03:16.3533333+00:00

https://supportportal.crowdstrike.com/s/article/ka16T000001tulaQAA

Official CS explanation

1 answer

Your answer

CtrlAltSec Cyber_Stoic 0 Reputation points

2025-06-27T11:03:16.3533333+00:00

https://supportportal.crowdstrike.com/s/article/ka16T000001tulaQAA

Official CS explanation

Answer 1

Anonymous

Hello Wong, Herman ., Sheriff,

Thank you for posting in Q&A forum.

What is scriptControl64_17605.dll about?

The event is logged as while the file scriptControl64_17605.dll is signed by third-part, it is not co-signed by Microsoft.

This is expected behavior, and the Windows Event can be ignored.

Here are two similar threads for your reference.
https://superuser.com/questions/222787/image-hash-of-file-is-not-valid

https://support.sophos.com/support/s/article/KB-000042815?language=en_US

Note: This response contains links to third parties, we provide this link for convenience of reference, Microsoft cannot guarantee the validity of any information and content in this link.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Wong, Herman ., Sheriff 10 Reputation points

2023-12-29T17:12:22.0433333+00:00

fyi, the "scriptControl64_17605.dll" file seems to be installed by Crowdstrike (version 7.04.17605.0). i agree, we could ignore this error. however, please see the screenshot: the file does appear to have a digital signature from Microsoft. Anyone have thoughts about the presence of the MS digital signature?
Christian Wood 0 Reputation points

2025-03-18T04:33:44.4066667+00:00
I would also prefer to resolve the cause, as it creates thousands of unnecessary entries in the Security Event log. As Wong, Herman ., Sheriff pointed out, the file is signed by Microsoft. Could the issue be related to the warning identified by SignTool, "No page hashes are present"? Below are the outputs from the SignTool verify commands, the first specifying the Windows Driver Verification Policy, and the second specifying the Default Authenticode Verification Policy.

C:\Windows\System32>signtool verify /a /v /ph /debug c:\Windows\System32\ScriptControl64_19205.dll

Verifying: c:\Windows\System32\ScriptControl64_19205.dll

Unable to verify this file using a catalog.

Signature Index: 0 (Primary Signature)

Hash of file (sha256): 6DD7A7E71542CA81BA32FA886BAA7F8902DE1CCDC54F1192B40164F95EE82C33

Signing Certificate Chain:

Issued to: Microsoft Root Certificate Authority 2010 Issued by: Microsoft Root Certificate Authority 2010 Expires: Sun Jun 24 06:04:01 2035 SHA1 hash: 3B1EFD3A66EA28B16697394703A72CA340A05BD5 Issued to: Microsoft Windows Third Party Component CA 2012 Issued by: Microsoft Root Certificate Authority 2010 Expires: Mon Apr 19 07:58:38 2027 SHA1 hash: 77A10EBF07542725218CD83A01B521C57BC67F73 Issued to: Microsoft Windows Hardware Compatibility Publisher Issued by: Microsoft Windows Third Party Component CA 2012 Expires: Thu May 15 06:16:06 2025 SHA1 hash: BDC9B8C37C6B71791A584EC19F2069D98042DC0A

The signature is timestamped: Sun Jan 12 01:19:40 2025

Timestamp Verified by:

Issued to: Microsoft Root Certificate Authority 2010 Issued by: Microsoft Root Certificate Authority 2010 Expires: Sun Jun 24 06:04:01 2035 SHA1 hash: 3B1EFD3A66EA28B16697394703A72CA340A05BD5 Issued to: Microsoft Time-Stamp PCA 2010 Issued by: Microsoft Root Certificate Authority 2010 Expires: Tue Oct 01 02:32:25 2030 SHA1 hash: 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6 Issued to: Microsoft Time-Stamp Service Issued by: Microsoft Time-Stamp PCA 2010 Expires: Thu Mar 06 02:45:48 2025 SHA1 hash: 4B708F358316DE6B5131DA615B5F1EDC93ED20FF

SignTool Warning: No page hashes are present.

Successfully verified: c:\Windows\System32\ScriptControl64_19205.dll

Number of files successfully Verified: 1

Number of warnings: 1

Number of errors: 0

C:\Windows\System32>SignTool verify /pa c:\Windows\System32\ScriptControl64_19205.dll

File: c:\Windows\System32\ScriptControl64_19205.dll

Index Algorithm Timestamp

========================================

0 sha256 RFC3161

Successfully verified: c:\Windows\System32\ScriptControl64_19205.dll

Share via

win11 audit failure on "scriptControl64_17605.dll"

1 answer

Your answer