malwarebytes MalwareBytes + Action Mirillis + wmplayer = Exploit ROP gadget attack blocked

[charlieware]

Hi. How are you?

I write to you because I have a very rare problem.

It turns out that MalwareBytes Premium 3.1.2 detects as Exploit the videos of windows media player and vlc media player.

When I have Action Mirillis open (capture program), the generated videos are automatically closed by MalwareBytes detecting them as Exploit. Other videos not created by Action are also closed.

But if I have Action Mirillis closed, the videos are not detected as Exploit and they open without problems.

What is happening?

It is very rare because it has never given problems of this type.

Thanks in advance.

(Copy of report) Spanish

Malwarebytes
www.malwarebytes.com

-Detalles del registro-
Fecha del evento de protección: 23/5/17
Hora del evento de protección: 12:10
Archivo de registro: action.txt
Administrador: Sí

-Información del software-
Versión: 3.1.2.1733
Versión de los componentes: 1.0.122
Versión del paquete de actualización: 1.0.2001
Licencia: Prueba

-Información del sistema-
SO: Windows 10
CPU: x64
Sistema de archivos: NTFS
Usuario: System

-Detalles de exploit-
Archivo: 0
(No hay elementos maliciosos detectados)

Exploit: 1
Malware.Exploit.Agent.Generic, , Bloqueado, [0], [-1],0.0.0

-Datos de exploit-
Aplicación afectada: Windows Media Player (wmplayer)
Capa de protección: Protection Against OS Security Bypass
Técnica de protección: Exploit ROP gadget attack blocked
Nombre de archivo:
URL:

 

(end)

[dcollins]

Can you walk us through your setup with the different pieces of software so we can try to replicate?

[charlieware]

Agree. What do they need to know?

[dcollins]

I'm just curious how you're using the two pieces of software. Are you play a local video in VLC and using Action Mirillis to make a duplicate? Are you playing a streaming URL? 

[charlieware]

Malwarebytes runs from the start windows.

The case is that when I open Action Mirillis, if I record a video, and if action mirillis is open, Malwarebytes detects them as Exploit and the videos are opened and closed instantly.

However, if Mirillis is closed, the videos open seamlessly. I do not get it.

I'm not playing playing a streaming URL.

He has never given me problems, so I do not understand what is happening.