Officially, according to IANA (the Internet Assigned Numbers Authority), port 1023 is "reserved", whether being used for TCP or UDP.
Many sites claim to list the known software packages (legit and malware) and well-known protocols that use various ports, and it's hard to know who to trust. However, this listing at SpeedGuide.net seems pretty legit, and lists the following known users:
- A couple variants of the "Sasser" malware
- NetMeeting with H323
- Nortel NetVenue Notification, Chat, Intercom
- Linux backend of Gateway GS-400 NAS
If you aren't aware of people in your company running Nortel NetVenue or Microsoft NetMeeting (which used to be built into Windows, I think), and if it's likely people may still be running Windows XP or Windows 2000, then they could well be infected with the "Sasser" malware. Then again, it could be some other piece of software that happened to use that port.