All credit goes to SandboxEscaper.
Added a payload.dll (exploit.dll in the project) that adds local admin using WinExec
This won't crash spoolsv.exe unlike msf and cobalt payloads, probably because these don't return true or exit on process which terminates spools.
Modify the command to suit your needs. Use ur imagination.