This sounds rather like the classic "Robin hood and friar tuck" attack.

I created a Windows program that did this (experimentally; it had no detrimental effect, wasn't intended for any malicious purpose, wasn't distributed and I didn't publish the source) about 6 years ago.

I discovered that in order to be effective, I attach debuggers to both processes, suspending them. Then I get the debuggers to kill both the (now-suspended) processes, in any order I want (they won't restart as they're both suspended).

That worked fine.

Slarty