Which winapi function does the Process Explorer use to suspend process?

Question

I am attempting to write a hook which will catch "SomeFunction" of Process Explorer that suspends process. I already have a solution which hooks functions such as SuspendThread and NtSuspendThread. But the Process Explorer use something different and I don't know what. Please can anyone tell me the name of the function used by PE to suspend process?

Answer 1

Attach it to an API Monitor; It calls NtOpenProcess -> NtSuspendProcess()