[M.A.D.M.A.N.]

Вот оно чё:

If you call this function shortly after creating the process, or if the process was created suspended, the module list may not have been created yet and this function fails with ERROR_INVALID_HANDLE.

ПРидется ковырять в сторону NtQuerySystemInformation, или еще того хуже.