Which winapi function does the Process Explorer use to suspend process?

Question

I am attempting to write a hook which will catch "SomeFunction" of Process Explorer that suspends process. I already have a solution which hooks functions such as SuspendThread and NtSuspendThread. But the Process Explorer use something different and I don't know what. Please can anyone tell me the name of the function used by PE to suspend process?

Sulfide

Have you checked the import table? Have you done anything at all to help yourself before asking here? – Thermit

Answer 1

Attach it to an API Monitor; It calls NtOpenProcess -> NtSuspendProcess()

Welcher

What API monitor did you use here? – Nimesh

Thanks, that looks very nice. I'll dig into it some more, always in the market for good tools. – Nimesh

Thanks, that's it! I tried to hook NtSuspendThread in procexp.exe but without results. I hooked this function in procexp64.exe and it works!!! Thanks a lot!!! – Sulfide