OT: File Overwrite Capture ?

[countachl <countachl@xxxxxxxxxxx>]

I am wondering if anyone knows of a utility that will capture the
writing of a file, specifically an EXE file.   I want to capture the
program or module that is doing the writing.

thanks

donc