Access control in Windows is on a per-object basis. If you want to protect the process object, you need to set the ACL of the process object, either when the process is created (through lpProcessAttributes of CreateProcess), or afterwards (through SetKernelObjectSecurity). If you add a "deny all" entry to the ACL, attempts to open the process by an attacker will fail.
Of course, the owner of the process (and thus any malicious code run by the user) can change the ACL back to what it was - malicious code may not be prepared to do so, though. To prevent attacks from user space effectively, you need to run the process as a non-interactive user (e.g. as LocalSystem).
No amount of protection can prevent attacks from kernel space, so anybody who can install drivers can also hack any process on the system.