Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
As a quick starter for 10, see this page:
The call in question is PsSetCreateProcessNotifyRoutine
Then this page
So the answer is this package is installing a kernel level driver to hook system calls, or rather respond to kernel events and alter the outcome. My knowledge of kernel-mode programming is limited, but I suspect functions such as IoRegisterContainerNotification can be used to create hooks into IO activity and determine what to allow and what to block.
I should advise you - this level of operation is different from a rootkit only in terms of intent and install method, i.e. that you are consensually letting this driver be installed and that you trust it. This software appears entirely innocent but you should be careful when deciding whether or not to install software that does this sort of thing, so evaluate solutions like this carefully.
Edit Just for interests' sake I ran