I had this same issue occur twice to me for the first time today. The second time, it was from the IP address 126.96.36.199, which is based in Taiwan. The first time was an IP address from nearby me in Washington state (I don't have the IP address, and my Zone Alarm logs keep getting corrupted). Perhaps it is some kind of attack that tries to exploit lsass.exe? I denied it when ZA showed the alert, as you did, so I doubt that there is any threat to our systems.