We only need write only access to the Procmon trace file handle.

Yes I'm nitpicking, but quite frankly I don't understand why procmon is letting you get read access to the file.