option explicit

Const PROCESS      = "EWBIC.exe"
Const MEM_LIMIT_KB = 511999
Const SERVICE_NAME = "IC Service" '! make sure to use the service name here not the displayname of the service

Dim objSWbemObject, strComputer
Dim objSWbemServices, objSWbemEventSource
Dim objProcess, iPID, iMem

strComputer = "."

Set objSWbemServices = GetObject("winmgmts:" _
   & "{impersonationLevel=impersonate}!\\" _
   & strComputer & "\root\cimv2")

' Enable the SeDebugPrivilege privilege to terminate
' processes running under a different security context.
objSWbemServices.Security_.ImpersonationLevel = 3
objSWbemServices.Security_.privileges. _
   addasstring "SeDebugPrivilege", True

Set objSWbemEventSource = objSWbemServices.ExecNotificationQuery( _
   "SELECT * FROM __InstanceModificationEvent WITHIN 60 Where (" & _
   "TargetInstance ISA 'Win32_Process' AND " & _
   "TargetInstance.Name='" & PROCESS & "' AND " & _
   "TargetInstance.WorkingSetSize > " & MEM_LIMIT_KB *1024 & ")")

On Error Resume Next
Do: Set objSWbemObject = objSWbemEventSource.NextEvent()

   Select Case objSWbemObject.TargetInstance.Path_.Class

     Case "Win32_Process"
       wscript.sleep 10000 ' wait 10 seconds then re-check mem usage by this process

       For Each objProcess in getobject("winmgmts://").instancesof(_
         "Win32_Process Where Name = '" & PROCESS & "' AND WorkingSetSize > " & MEM_LIMIT_KB *1024)
         iPID = objProcess.Processid
         iMem = objProcess.WorkingSetSize /1024

         objProcess.Terminate()  ' optional

         call notifyMe (iPID, iMem)

         ' stop/start service (do not use its displayname here)
         With objSWbemServices.Get("Win32_Service.Name='"  & SERVICE_NAME & "'")
           .StopService()
           wscript.sleep 10000 ' wait 10 seconds
           .StartService()
           wscript.sleep 10000 ' wait 10 seconds
         End With
       Next

   End Select

Loop

Sub notifyMe (PID, Mem)

   With CreateObject("WScript.Shell")
     .popup PROCESS & " [ID " & PID & "] terminated " _
       & "because its memory usage was: " & Mem & " kb", _
       5, strComputer & " Event", 0+64
   End With

End Sub