im working on an program which is process-hidden and anti-attach, I just want to know how does it do? so I trace DebugActiveProcess, then I find out rtlCreateUserThread return failed with eax=1.

Anyone knows why it will be? I don't have any deep resource discussing about the NtCreateThread.

Thanx if there is any comment could help.

GetLastError() = ?