How to Identify the Process Hogging Memory on Windows 11

Quick fix: Open Task Manager → Processes tab, click the Memory column header to sort descending — the process at the top is your memory hog. For deeper analysis use Resource Monitor (resmon) or the Performance tab’s Memory section.

Task Manager shows 90% memory usage but you only have a couple of apps open. Something is consuming gigabytes invisibly. Memory leaks in long-running apps, runaway background processes, browser tabs you forgot about, or a memory-hungry indexer — identifying which one takes 30 seconds with the right view.

What causes this

Four common patterns: a long-running app with a memory leak (Chrome with many tabs, Visual Studio after hours of use, Adobe apps); a runaway background process (a crashed app stuck in a memory loop); a cache buildup (Search Indexer, Defender quarantine, or Standby memory holding files you accessed earlier); or virtual machine / Docker / WSL2 reserving large blocks of RAM even when idle.

Task Manager’s Memory column shows working set (RAM actively used). Resource Monitor breaks this down into commit, working set, and standby — important for separating “memory in use” from “memory available for use.”

Method 1: Find the top consumers in Task Manager

Always start here. Identifies visible processes in one click.

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Click the Processes tab.
3. Click the Memory column header to sort descending. Top of the list is the biggest consumer.
4. Common offenders and what they mean:
   • Browser (Edge, Chrome, Firefox): many tabs or extensions. Close unused tabs; consider The Great Suspender or built-in tab sleeping.
   • Microsoft Teams: classic Teams used 1+ GB. New Teams is leaner. Make sure you’re on new Teams.
   • Visual Studio / IntelliJ / VS Code with many extensions: restart the IDE periodically.
   • Antimalware Service Executable: Defender mid-scan. Wait it out or pause if you can.
   • vmmem / vmmemWSL: WSL2 holding memory. Run wsl --shutdown in PowerShell to release.
   • Docker Desktop: idle containers still hold RAM. Stop unused containers.
5. For non-essential processes, right-click and choose End task. Memory drops within seconds.

If the top process is something unexpected (an unfamiliar EXE name), right-click and choose Open file location to see where it lives. Suspicious locations (anywhere outside C:\Windows, C:\Program Files, legitimate vendor folders) suggest malware.

Method 2: Use Resource Monitor for committed vs standby memory

Reveals whether memory is genuinely in use or just cached.

1. Press Win + R, type resmon, press Enter.
2. Click the Memory tab.
3. The top section shows running processes sorted by Commit (KB). This is private memory each process has reserved.
4. The graph at the bottom shows memory categorized as:
   • In Use — actively used by processes (red)
   • Modified — being written to disk by pagefile (orange)
   • Standby — cached but available if needed (green)
   • Free — completely unused (blue)
5. If your “memory in use” in Task Manager is high but Resource Monitor shows most of it as Standby, that’s normal cache behavior — Windows holds recently-used data in RAM so it doesn’t need to re-read from disk. It frees automatically when other apps need RAM.
6. If “In Use” itself is high, focus on the top processes in the upper list and end the runaways.

This view distinguishes a real memory pressure problem from a cache-keeping-RAM-warm situation. Standby memory looks bad in Task Manager but is actually good.

Method 3: Use Performance Monitor to track memory leaks over time

For chronic memory growth — an app that starts at 200 MB and grows to 3 GB over hours.

1. Open Performance Monitor (perfmon) from the Start menu.
2. Click Performance Monitor in the left tree.
3. Click the green plus to add a counter.
4. Under Process, select Private Bytes.
5. Under Instances of selected object, choose the suspect process (e.g., chrome, devenv, code).
6. Click Add → OK.
7. Let it run for 30+ minutes. The graph shows memory growth over time.
8. If the line trends steadily upward without leveling off, the process has a memory leak — restart it as a workaround, report the bug to the vendor.

This is the diagnostic step for leaks rather than just runaway consumption. A leak grows continuously; runaway consumption plateaus.

How to verify the fix worked

• After ending the runaway process, Task Manager Performance tab → Memory should drop to a reasonable level (under 60% with normal apps open).
• Run Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 Name, @{N='RAM_MB';E={[math]::Round($_.WorkingSet64/1MB)}} in PowerShell. Top processes should be expected ones.
• System feels more responsive — app launches, browser tab switches, window animations should all be snappier.

If none of these work

If memory usage is high but no individual process explains it, the cause is likely kernel-level or driver-related. Run poolmon.exe from the Windows SDK Debugging Tools (or download as part of the WDK). Sort by Bytes to see kernel pool allocations by tag — the tag identifies which driver is allocating memory. Cross-reference the tag with Microsoft’s pool tag list (search for pooltag.txt) to identify the source. Common kernel-memory hogs: outdated graphics drivers (allocate large amounts under tag AGP or driver-specific tags), faulty audio drivers, and network filter drivers from old VPN software. For chronic high memory usage that no diagnostic identifies, the simplest workaround is to add more RAM — 8 GB is the practical Windows 11 minimum, 16 GB is comfortable, 32 GB handles modern workflows including VMs and Docker.

Bottom line: Memory hogs hide in plain sight in Task Manager — sort by Memory column, end the runaway, then use Resource Monitor to confirm what’s real usage vs cache.