You can use:
1) procmon. Which is available for download from Microsoft at:
and then add a filter, select to filter by operation and set the filter value to be one of the registry operations that you suspect... I would suggest filtering by (RegSetValue) or could look for everything that has "Reg" in it. It is pretty straight forward, but it would be much more efficient if you knew when the suspicious process is accessing the registry.
2) regshot. available at:
RegShot can take a snapshot of your registry. Then once you suspect that something has taken place, you can take another snapshot and compare (diff) the two snapshots to see what changed.
I wish you good luck.