You can find a lot of resources about the internals of
zwQueryInformationProcess because that information is undocumented. As nordwald said, detecting malware with
zwQueryInformationProcess is possible, and more so in several ways but I would like to focus on something slightly different for this answer.
The general task of detecting malware in a process is usually pretty complex, specially when you aim to perform it generically and for multiple malware families. There are books about the topic and articles upon articles on related subjects. There are dozens if not hundreds of techniques malware can avoid detection, bypass protections and prevent analysis. There are multiple ways to avoid or mitigate most of those tricks and successfully detect malware samples that employ them. There's a huge market for malware detection with dozens of products attempting to detect and block viruses. Some would say that industry is falling behind of malware writers and it is generally quite feasible to make a malware FUD (fully undetected).
This is a huge domain with a lot of written material and aggregated knowledge.
Detecting malware is not something you could do with something as simple as using raw data instead of calling an API. Companies fail at doing that after investing millions of dollars, and much more.
I do not aim to discourage you from pursuing that or similar goals, I do however think you should make some effort at reading existing material to quickly further your understanding of the malware and anti-virus world, good luck!