Under the Hood: Understanding dlltop – A Hidden Gem for Windows Process Analysis
dlltop -p 1234 -s workingSet This command targets PID 1234 and sorts loaded DLLs by working set size (physical memory). Sample output: dlltop
Download Sysinternals listdlls.exe and pipe it to sort – that’s your manual dlltop . Better yet, write your own version with psutil in Python for cross-platform DLL tracking. Under the Hood: Understanding dlltop – A Hidden
Get-Process -Id 1234 | Select-Object -ExpandProperty Modules | Sort-Object -Property Size -Descending | Select-Object -First 10 ModuleName, FileName, Size For live updates, wrap it in a loop: Subscribe to our newsletter for more Windows internals
Have you ever debugged a rogue DLL? Share your story in the comments below. Found this useful? Subscribe to our newsletter for more Windows internals deep-dives.
April 13, 2026 Category: Windows Internals & Debugging
PID: 1234 - explorer.exe Rank DLL Name Working Set (KB) 1 C:\Windows\System32\shell32.dll 12,456 2 C:\Program Files\CloudPlugin.dll 8,234 3 C:\Windows\System32\ole32.dll 3,112 ... Since dlltop isn’t built into Windows, here’s a quick script to get similar insight: