It's really just the sum of the time it takes to execute both algorithms on that "normal" hardware. If you can test 100,000 SHA-1 iterations per second on the machine, and 50,000 AES256 decryptions per second, .00001 + .00002 = .00003, or 33,333 tests per second.
But there's a lot you didn't answer. How much keyspace are you willing to search? If the password is 1 alphabetic character, your answer will be virtually instant. If the password is 100 bytes long, the ashes of the universe will have cooled before you have recovered the password.
Your example features an 8 character password. If I know I have to test all 8 character alphanumeric passwords, that's 62^8 tests, or only 218 trillion attempts. If a desktop machine can test 10 million passwords per second, it will have searched the space in about 21 million seconds (252 days).
But who is attacking? What is their motivation? If it's a national security organization, their idea of a normal password cracker is different than yours. A criminal organization wanting to steal millions of dollars from a stock brokerage or a bank would certainly invest $100,000 in cracking it quicker. They would likely farm such a task out to a botherder, who might assign 1,000 internet zombie machines to crunch away at the task, cracking it in a day or two.