Check svchost
Make sure to run the Process Explorer as administrator, click on the svchost you want to inspect, click the View DLLs button (or CTRL+D). Right click the headers in the DLLs window, Select Columns, then check WS Total Bytes, and hit OK. Now you can view and sort on the memory usage of individual services (implemented by dlls) within the svchost.