Отслеживание закрытия файла процессом, запущенным через CreateProcess

STARTUPINFO si;
PROCESS_INFORMATION pi;
 
ZeroMemory(&si, sizeof(si));
si.cb = sizeof(si);
ZeroMemory(&pi, sizeof(pi));
 
CreateProcess
    (
        TEXT("C:\\Program Files (x86)\\Microsoft Office\\Office15\\WINWORD.EXE"),
        L"/t C:\\Temp\\file.docx", NULL, NULL, TRUE,
        CREATE_NEW_CONSOLE,
        NULL, NULL,
        &si,
        &pi
    );

typedef int (WINAPI *CREATEFILE)(LPCTSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
 
CREATEFILE fpCreateFile = NULL;
 
int WINAPI DetourCreateFile(LPCTSTR lpctst, DWORD dw1, DWORD dw2, LPSECURITY_ATTRIBUTES sec_attr, DWORD dw3, DWORD dw4, HANDLE hndl)
{
    cout << "HOOKED" << endl;
    return 0;
}
 
VOID PrintModuleList(HANDLE CONST hStdOut, DWORD CONST dwProcessId);
 
int _tmain(int argc, _TCHAR* argv[])
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
 
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));
    
        MH_Initialize();
    
        CreateProcess
        (
    TEXT("C:\\Program Files (x86)\\Microsoft Office\\Office15\\WINWORD.EXE"),
    L"/t C:\\Temp\\sendMEplease.docx", NULL, NULL, TRUE,
    CREATE_NEW_CONSOLE,
    NULL, NULL,
    &si,
    &pi
    );
 
    DWORD pId = pi.dwProcessId;
    DWORD ExitCode;
    PROCESSENTRY32 peProcessEntry;
    TCHAR szBuff[1024];
    DWORD dwTemp;
    HANDLE CONST hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
    HANDLE CONST hSnapshot = CreateToolhelp32Snapshot(
        TH32CS_SNAPPROCESS, pId);
 
    if (INVALID_HANDLE_VALUE == hSnapshot) {
        return 0;
    }
    peProcessEntry.dwSize = sizeof(PROCESSENTRY32);
    Process32First(hSnapshot, &peProcessEntry);
    do {
        if (peProcessEntry.th32ProcessID == pId) {
            PrintModuleList(hStdOut, peProcessEntry.th32ProcessID);
            break;
        }
    } while (Process32Next(hSnapshot, &peProcessEntry));
 
    CloseHandle(hSnapshot);
    MH_Uninitialize();
    return 0;
}
 
 
VOID PrintModuleList(HANDLE CONST hStdOut, DWORD CONST dwProcessId) {
    MODULEENTRY32 meModuleEntry;
    TCHAR szBuff[1024];
    DWORD dwTemp;
    HANDLE CONST hSnapshot = CreateToolhelp32Snapshot(
        TH32CS_SNAPMODULE, dwProcessId);
    if (INVALID_HANDLE_VALUE == hSnapshot) {
        return;
    }
 
    meModuleEntry.dwSize = sizeof(MODULEENTRY32);
    Module32First(hSnapshot, &meModuleEntry);
    string str = "kernel32.dll";
    wstring w_str(str.begin(), str.end());
    do {
        if (meModuleEntry.szModule == w_str)
        {
            MH_CreateHook(&CreateFile, &DetourCreateFile,
        reinterpret_cast<LPVOID*>(&fpCreateFile));
            MH_EnableHook(&CreateFile);
            cout <<"kernel32.dll was found" << endl;
            break;
        }
    } while (Module32Next(hSnapshot, &meModuleEntry));
 
    CloseHandle(hSnapshot);
}

    HMODULE hModuleSelf = GetModuleHandle(NULL);
    void* p = GetProcAddress(hModuleSelf, "LoadLibrary");
    cout << p << endl;

void injectDLL(HANDLE hProcess)
{
    char* dll = "c:\\users\\adam\\documents\\visual studio 2015\\Projects\\HookDll\\Debug\\HookDll.dll";
 
    LPVOID lpSpace = (LPVOID)VirtualAllocEx(hProcess, NULL, strlen(dll), MEM_COMMIT, PAGE_READWRITE);
    
    int n = WriteProcessMemory(hProcess, lpSpace, dll, strlen(dll), NULL);
 
    HMODULE hModule = GetModuleHandle(L"kernel32.dll");
    
    LPVOID lpBaseAddress = (LPVOID)GetProcAddress(hModule, "LoadLibraryW");
    
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpBaseAddress, lpSpace, NULL, NULL);
    
};

#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
 
INT APIENTRY DllMain(HMODULE hDll, DWORD Reason, LPVOID Reserved)
{
    MessageBox(NULL,L"DLL", L"DllMain",MB_OK);
    FILE *file;
    fopen_s(&file, "c:\\temp.txt", "a+");
 
    switch (Reason)
    {
    case DLL_PROCESS_ATTACH:
        fprintf(file, "DLL attach function called.n");
        break;
    case DLL_PROCESS_DETACH:
        fprintf(file, "DLL detach function called.n");
        break;
    case DLL_THREAD_ATTACH:
        fprintf(file, "DLL thread attach function called.n");
        break;
    case DLL_THREAD_DETACH:
        fprintf(file, "DLL thread detach function called.n");
        break;
    }
 
    fclose(file);
    return TRUE;
};