can it be monitored, for x64 call under wow64?
maybe like this
...;called: C:\Windows\SysWOW64\ntdll.NtQueryInformationProcess
... // Wow64Transition
...;called: C:\Windows\System32\ntdll.NtQueryInformationProcess
for some use wow64ext, it may be better.