Is there a way to see which dll created a specifc .txt file in a specific location?

Question

I'm new to SysInternals and I have a text file being created and I'm not sure which .exe or .dll is creating the .txt file.

• Which SysInternal tool would be best for this?
• If it's Procmon, how would I filter it to find it?
• Does the process have to be actively writing the file for me to find it? It happens overnight and I wouldn't think it takes long to create, it's a very small file.

I'm not good at filtering Procmon. If I can research this while it's not actively writing the file, I would need to be able to filter for a time range as it happens overnight.

Thanks for your help!

Answer 1

You can use ProcMon and add a filter with "Path"
(with contains or is if you know the complete path)

For example, to test, I added Path contains "tata" and it has been logged when I created a file "E:\Temp\tata.txt" with Notepad)