Can someone explain me what these 2 accounts are used for?
I know that the application pool account controls the permission that apply to .NET code of a website.
If this account has no write permission to a directory then you can't create files for example.
However there is one more account IISUSR which is the account for anonymous authentication.
In what way does this account relate to the .NET code and access to a website?
Why do we need 2 accounts?
The IIS_Anonymous account is the the account that the user accessing the site runs as. So you want to make sure that this user can't access any files outside of the web root and files with sensitive information IE sql connection strings etc. You generally don't want to allow this user write access anywhere.
The App pool account is the account your app (or the IIS server) runs under. You want to give this account the bare minimum access it needs to run your script. If you are security conscious you will create different app pools for each site, so that a security misconfiguration on one site will not leak to another.
There is a similar question here on Serverfault:
Understanding the IUSR_ account
I wrote:
Most people have a hard time understanding the difference between IIS' anonymous user (IUSR_...) and the account used executing binaries (the application pool account).
The IUSR account is used when the user isn't authenticated on the server which is - for "normal" websites - is the default use case. For intranet sites you could disable anonymous access to the IIS server and let users (automatically) submit their network/domain credentials.
The anonymous account's permissions on files and folders determines which resources (files) the normal web user can access on that server. Normally all (static) files are read-only and you don't allow listing of the folder content.
The application pool identity (e.g. the Network Service account) is something different. It's the account that executes your scripts or assemblies, the process identity. For example, if your application wants to write to a certain folder (e.g. C:\temp) that account must have the filesystem permission to modify files in that folder.
