Sometimes, AV and sandboxing software will end up modifying function pointer tables in the kernel. Short of writing a driver, there is no easy way to get around that, because the functionality may be disabled system-wide (what AV's do) or for a particular application (what sandboxes would do).
If you are actually able to open a handle to the process, you can still do a lot of things. Maybe you could try killing it indirectly. I would try to write directly to the process' memory and overwrite it with garbage (or calls to ExitProcess).