How to grab a Memory Dump of the W3WP.exe process

The nice thing about IIS7 is that you can use Failed Request Tracing and Runtime Service Control API (RSCA).

At the top level, go to the worker processes icon, then drill into your worker process and see which page is running the longest. That's likely the cause. Once you've narrowed down to the appropriate page, then turn on Failed Request Tracing in IIS7 at the site level. Set it for just the bad page. Once you've captured a page running poorly, the .xml results can hopefully help point you in the right direction.

After digging through the documentation (based on the other answers here), this is the process I ended up using:

1. Capture the ETW log of the problem

   The easiest way to do this is using the Windows Performance Recorder. I'm not sure when it first appeared, but seems to be built in on recent versions of Windows. Set the profile to CPU usage.

   

   or, using an elevated command prompt, navigate to the folder which contains it and use the command-line tool xperf:

   xperf -on base+interrupt+dpc
   

   Note, you will need to close Process Monitor or any other app which uses ETW or you will get the following error: xperf: error: NT Kernel Logger: Cannot create a file when that file already exists. (0xb7).

2. Stop tracing / save the log

   xperf -d interrupt_trace.etl
   

3. Open the trace in Windows Performance Analyzer (part of Windows Performance Toolkit); some places mention using xperfview instead.

4. Expand Computation -> CPU Usage (Sampled) -> DPC and ISR Usage by Module, Stack, right-click and add graph to analysis view

   

5. This pointed right to the driver in question. In this case, HDAudBus.sys is using a constant 10.82% of my cpu via interrupts, which is exactly what Process Explorer was showing me.