BumbleBee DLL Sideloading via consent.exe Loading msimg32.dll Outside System32

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.