Where do entries from regsvr32-registered DLLs get stored

Solution 1:

regsvr32 is basically calling LoadLibrary then DllRegisterServer in the DLL. so the actually behavior would depend on how the DLL is coded.

Most DLLs don't have a DllRegisterServer function, like the Visual C++ runtime or most Windows DLLs, thus regsvr32 won't work on them. For those that actually do, usually the expectation is that the DLL hosts home kind of COM server and in order to find a server, COM needs to have its location and capability in registry. Thus normally you would see mostly registry writes when you monitor regsvr32 in Process Monitor.

That said, a malicious DllRegisterServer can do anything to your computer. E.g. here is one that launches an installer (https://securityliterate.com/chantays-resume-investigating-a-cv-themed-zloader-malware-campaign/).